preparing to trace all blocks...

merge-requests/4/head
_xeroxz 4 years ago
parent 8a0870607e
commit 97a0bb5f26

@ -12,6 +12,7 @@ namespace vm
std::uintptr_t stack_base = 0x1000000;
std::uintptr_t stack_addr = ( stack_base + ( 0x1000 * 20 ) ) - 0x6000;
const auto rip = vmctx->module_base + vmctx->vm_entry_rva;
const auto image_size = NT_HEADER( vmctx->module_base )->OptionalHeader.SizeOfImage;
if ( ( err = uc_open( UC_ARCH_X86, UC_MODE_64, &uc ) ) )
{
@ -20,7 +21,7 @@ namespace vm
return false;
}
if ( ( err = uc_mem_map( uc, vmctx->module_base, vmctx->image_size, UC_PROT_ALL ) ) )
if ( ( err = uc_mem_map( uc, vmctx->module_base, image_size, UC_PROT_ALL ) ) )
{
std::printf( "failed on uc_mem_map() with error returned %u: %s\n", err, uc_strerror( err ) );
@ -35,7 +36,7 @@ namespace vm
}
if ( ( err = uc_mem_write( uc, vmctx->module_base, reinterpret_cast< void * >( vmctx->module_base ),
vmctx->image_size ) ) )
image_size ) ) )
{
std::printf( "failed on uc_mem_write() with error returned %u: %s\n", err, uc_strerror( err ) );
@ -210,8 +211,20 @@ namespace vm
if ( jcc.has_value() )
obj->code_blocks->back().jcc = jcc.value();
// set the next code block up...
obj->code_blocks->push_back( vm::instrs::code_block_t{ code_block_address } );
if ( auto already_traced = std::find_if( obj->code_blocks->begin(), obj->code_blocks->end(),
[ & ]( const vm::instrs::code_block_t &code_block ) -> bool {
return code_block.vip_begin == code_block_address;
} );
already_traced != obj->code_blocks->end() )
{
// stop tracing, dont step up the next code block since we already traced it...
uc_emu_stop( uc );
}
else
{
// set the next code block up...
obj->code_blocks->push_back( vm::instrs::code_block_t{ code_block_address } );
}
}
}
else if ( instr.mnemonic == ZYDIS_MNEMONIC_RET ) // finish tracing...

Binary file not shown.
Loading…
Cancel
Save