From bb96f4ca950b5f0a4e2c4bb7d01542e25bfa88a0 Mon Sep 17 00:00:00 2001
From: _xeroxz <xerox@back.engineering>
Date: Sun, 13 Jun 2021 02:25:49 +0000
Subject: [PATCH] Update README.md

---
 README.md | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/README.md b/README.md
index a509419..b664141 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,74 @@ if ( !vmctx.init() )
 }
 ```
 
+### Using vm::ctx_t Object
+
+Once you have instantiated `vm::ctx_t` and called `vm::ctx_t::init` with success, you now can directly access the data members of `vm::ctx_t`. Most importantly, `vm::ctx_t::calc_jmp`, `vm::ctx_t::vm_entry`, and `vm::ctx_t::vm_handlers`. An example usage of this data could be dumping the native x86_64 instructions which make up `vm::ctx_t::vm_entry`. Example c++ code for this is displayed below.
+
+```cpp
+std::puts( "======================== [vm entry] ========================\n" );
+vm::util::print( vmctx.vm_entry );
+```
+
+***Output***
+
+```
+======================== [vm entry] ========================
+> 0x00007FF7911A822C push 0xFFFFFFFF890001FA
+> 0x00007FF7911A7FC9 push 0x45D3BF1F
+> 0x00007FF7911A48E4 push r13
+> 0x00007FF7911A4690 push rsi
+> 0x00007FF7911A4E53 push r14
+> 0x00007FF7911A74FB push rcx
+> 0x00007FF7911A607C push rsp
+> 0x00007FF7911A4926 pushfq
+> 0x00007FF7911A4DC2 push rbp
+> 0x00007FF7911A5C8C push r12
+> 0x00007FF7911A52AC push r10
+> 0x00007FF7911A51A5 push r9
+> 0x00007FF7911A5189 push rdx
+> 0x00007FF7911A7D5F push r8
+> 0x00007FF7911A4505 push rdi
+> 0x00007FF7911A4745 push r11
+> 0x00007FF7911A478B push rax
+> 0x00007FF7911A7A53 push rbx
+> 0x00007FF7911A500D push r15
+> 0x00007FF7911A6030 push [0x00007FF7911A7912]
+> 0x00007FF7911A593A mov rax, 0x7FF6511A0000
+> 0x00007FF7911A5955 mov r13, rax
+> 0x00007FF7911A595F test dl, al
+> 0x00007FF7911A5965 push rax
+> 0x00007FF7911A5969 btr si, bx
+> 0x00007FF7911A596F mov esi, [rsp+0xA0]
+> 0x00007FF7911A5979 not esi
+> 0x00007FF7911A5985 neg esi
+> 0x00007FF7911A598D ror esi, 0x1A
+> 0x00007FF7911A599E mov rbp, rsp
+> 0x00007FF7911A59A8 sub rsp, 0x140
+> 0x00007FF7911A59B5 and rsp, 0xFFFFFFFFFFFFFFF0
+> 0x00007FF7911A59BE inc ax
+> 0x00007FF7911A59C1 mov rdi, rsp
+> 0x00007FF7911A59C7 bsr r12, rax
+> 0x00007FF7911A59CB lea r12, [0x00007FF7911A6473]
+> 0x00007FF7911A59DF mov rax, 0x100000000
+> 0x00007FF7911A59EC add rsi, rax
+> 0x00007FF7911A59F3 mov rbx, rsi
+> 0x00007FF7911A59FA add rsi, [rbp]
+> 0x00007FF7911A5A03 rcr dl, cl
+> 0x00007FF7911A5A05 mov al, [rsi]
+> 0x00007FF7911A5A0A xor al, bl
+> 0x00007FF7911A5A11 neg al
+> 0x00007FF7911A5A19 rol al, 0x05
+> 0x00007FF7911A5A26 inc al
+> 0x00007FF7911A5A2F xor bl, al
+> 0x00007FF7911A5A34 movzx rax, al
+> 0x00007FF7911A5A41 mov rdx, [r12+rax*8]
+> 0x00007FF7911A5A49 xor rdx, 0x7F3D2149
+> 0x00007FF7911A5507 inc rsi
+> 0x00007FF7911A7951 add rdx, r13
+> 0x00007FF7911A7954 jmp rdx
+```
+
 ### License & Copyright
 
 Copyright (c) 2021 _xeroxz, Independent Researcher @back.engineering