示例#1
0
static void BreakRet( mad_trace_data *td, mad_disasm_data *dd, const mad_registers *mr )
{
    address     sp;
    union {
        addr32_off      off32;
        addr48_off      off48;
    }           off;

    sp = GetRegSP( mr );
    switch( dd->ins.type ) {
    case DI_X86_iret:
        MCReadMem( sp, sizeof( off.off32 ), &off.off32 );
        sp.mach.offset += sizeof( off.off32 );
        td->brk.mach.offset = off.off32;
        MCReadMem( sp, sizeof( td->brk.mach.segment ), &td->brk.mach.segment );
        sp.mach.offset += sizeof( td->brk.mach.segment );
        break;
    case DI_X86_iretd:
        MCReadMem( sp, sizeof( off.off48 ), &off.off48 );
        sp.mach.offset += sizeof( off.off48 );
        td->brk.mach.offset = off.off48;
        MCReadMem( sp, sizeof( td->brk.mach.segment ), &td->brk.mach.segment );
        sp.mach.offset += sizeof( td->brk.mach.segment );
        break;
    default:
        if( dd->characteristics & X86AC_BIG ) {
            MCReadMem( sp, sizeof( off.off48 ), &off.off48 );
            sp.mach.offset += sizeof( off.off48 );
            td->brk.mach.offset = off.off48;
        } else {
            MCReadMem( sp, sizeof( off.off32 ), &off.off32 );
            sp.mach.offset += sizeof( off.off32 );
            td->brk.mach.offset = off.off32;
        }
        switch( td->prev_ins_type ) {
        case DI_X86_call:
        case DI_X86_call2:
        case DI_X86_ret:
        case DI_X86_ret2:
            td->brk.mach.segment = mr->x86.cpu.cs;
            break;
        case DI_X86_call3:
        case DI_X86_call4:
        case DI_X86_int:
        case DI_X86_into:
        case DI_X86_iret:
        case DI_X86_iretd:
        case DI_X86_retf:
        case DI_X86_retf2:
            MCReadMem( sp, sizeof( td->brk.mach.segment ), &td->brk.mach.segment );
            sp.mach.offset += sizeof( td->brk.mach.segment );
            break;
        default:
            break;
        }
    }
    MCAddrSection( &td->brk );
}
示例#2
0
char *ToSegStr( addr_off value, addr_seg seg, addr_off addr )
{
    address             memaddr;
    mad_type_handle     th;

    addr = addr;

    memaddr.mach.segment = seg;
    memaddr.mach.offset  = value;
    MCAddrSection( &memaddr );
    th = BIG_SEG( memaddr ) ? X86T_F32_PTR : X86T_F16_PTR;
    MCAddrToString( memaddr, th, MLK_MEMORY, sizeof( ScratchBuff ) - 1, ScratchBuff );
    return( ScratchBuff );
}