diff --git a/src/vmemu_t.cpp b/src/vmemu_t.cpp index 40eb557..e8d40d2 100644 --- a/src/vmemu_t.cpp +++ b/src/vmemu_t.cpp @@ -227,7 +227,12 @@ namespace vm obj->trace_entries->push_back( new_entry ); } else if ( instr.mnemonic == ZYDIS_MNEMONIC_RET ) // finish tracing... + { uc_emu_stop( uc ); + + std::printf( "> stopping at vmexit instruction...\n" ); + std::getchar(); + } } bool emu_t::hook_mem_invalid( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, diff --git a/src/vmemu_t.hpp b/src/vmemu_t.hpp index 0c3ecc2..8a67fee 100644 --- a/src/vmemu_t.hpp +++ b/src/vmemu_t.hpp @@ -11,6 +11,45 @@ namespace vm { + struct virt_instr_t + { + vm::handler::mnemonic_t mnemonic_t; + std::uint8_t opcode; // aka vm handler idx... + + struct + { + bool has_imm; + struct + { + std::uint8_t imm_size; // size in bits... + union + { + std::int64_t s; + std::uint64_t u; + }; + } imm; + } operand; + }; + + enum class jcc_type + { + none, + branching, + absolute + }; + + struct code_block_t + { + struct + { + bool has_jcc; + jcc_type type; + std::uint32_t branch_rva[ 2 ]; + } jcc; + + std::vector< virt_instr_t > vinstrs; + }; + class emu_t { using callback_t = std::function< void( uc_engine *, uint64_t, uint32_t, void * ) >;