diff --git a/README.md b/README.md index a509419..b664141 100644 --- a/README.md +++ b/README.md @@ -46,6 +46,74 @@ if ( !vmctx.init() ) } ``` +### Using vm::ctx_t Object + +Once you have instantiated `vm::ctx_t` and called `vm::ctx_t::init` with success, you now can directly access the data members of `vm::ctx_t`. Most importantly, `vm::ctx_t::calc_jmp`, `vm::ctx_t::vm_entry`, and `vm::ctx_t::vm_handlers`. An example usage of this data could be dumping the native x86_64 instructions which make up `vm::ctx_t::vm_entry`. Example c++ code for this is displayed below. + +```cpp +std::puts( "======================== [vm entry] ========================\n" ); +vm::util::print( vmctx.vm_entry ); +``` + +***Output*** + +``` +======================== [vm entry] ======================== +> 0x00007FF7911A822C push 0xFFFFFFFF890001FA +> 0x00007FF7911A7FC9 push 0x45D3BF1F +> 0x00007FF7911A48E4 push r13 +> 0x00007FF7911A4690 push rsi +> 0x00007FF7911A4E53 push r14 +> 0x00007FF7911A74FB push rcx +> 0x00007FF7911A607C push rsp +> 0x00007FF7911A4926 pushfq +> 0x00007FF7911A4DC2 push rbp +> 0x00007FF7911A5C8C push r12 +> 0x00007FF7911A52AC push r10 +> 0x00007FF7911A51A5 push r9 +> 0x00007FF7911A5189 push rdx +> 0x00007FF7911A7D5F push r8 +> 0x00007FF7911A4505 push rdi +> 0x00007FF7911A4745 push r11 +> 0x00007FF7911A478B push rax +> 0x00007FF7911A7A53 push rbx +> 0x00007FF7911A500D push r15 +> 0x00007FF7911A6030 push [0x00007FF7911A7912] +> 0x00007FF7911A593A mov rax, 0x7FF6511A0000 +> 0x00007FF7911A5955 mov r13, rax +> 0x00007FF7911A595F test dl, al +> 0x00007FF7911A5965 push rax +> 0x00007FF7911A5969 btr si, bx +> 0x00007FF7911A596F mov esi, [rsp+0xA0] +> 0x00007FF7911A5979 not esi +> 0x00007FF7911A5985 neg esi +> 0x00007FF7911A598D ror esi, 0x1A +> 0x00007FF7911A599E mov rbp, rsp +> 0x00007FF7911A59A8 sub rsp, 0x140 +> 0x00007FF7911A59B5 and rsp, 0xFFFFFFFFFFFFFFF0 +> 0x00007FF7911A59BE inc ax +> 0x00007FF7911A59C1 mov rdi, rsp +> 0x00007FF7911A59C7 bsr r12, rax +> 0x00007FF7911A59CB lea r12, [0x00007FF7911A6473] +> 0x00007FF7911A59DF mov rax, 0x100000000 +> 0x00007FF7911A59EC add rsi, rax +> 0x00007FF7911A59F3 mov rbx, rsi +> 0x00007FF7911A59FA add rsi, [rbp] +> 0x00007FF7911A5A03 rcr dl, cl +> 0x00007FF7911A5A05 mov al, [rsi] +> 0x00007FF7911A5A0A xor al, bl +> 0x00007FF7911A5A11 neg al +> 0x00007FF7911A5A19 rol al, 0x05 +> 0x00007FF7911A5A26 inc al +> 0x00007FF7911A5A2F xor bl, al +> 0x00007FF7911A5A34 movzx rax, al +> 0x00007FF7911A5A41 mov rdx, [r12+rax*8] +> 0x00007FF7911A5A49 xor rdx, 0x7F3D2149 +> 0x00007FF7911A5507 inc rsi +> 0x00007FF7911A7951 add rdx, r13 +> 0x00007FF7911A7954 jmp rdx +``` + ### License & Copyright Copyright (c) 2021 _xeroxz, Independent Researcher @back.engineering