diff --git a/include/vminstrs.hpp b/include/vminstrs.hpp
index 0855859..5bd1625 100644
--- a/include/vminstrs.hpp
+++ b/include/vminstrs.hpp
@@ -71,11 +71,107 @@ struct vinstr_t {
} imm;
};
+///
+/// virtual branch type...
+///
+enum class vbranch_type {
+ ///
+ /// vmexit
+ ///
+ none,
+
+ ///
+ /// virtual jcc
+ ///
+ jcc,
+
+ ///
+ /// absolute jmp...
+ ///
+ absolute,
+
+ ///
+ /// jmp table, either indirect or direct...
+ ///
+ table
+};
+
+///
+/// virtual code block
+///
+struct vblk_t {
+ ///
+ /// start address VIP of this basic block...
+ ///
+ struct {
+ ///
+ /// relative virtual address...
+ ///
+ std::uint32_t rva;
+
+ ///
+ /// image based relative virtual address...
+ ///
+ std::uintptr_t img_base;
+ } m_vip;
+
+ struct {
+ ///
+ /// unicorn-engine cpu context of the first instruction of the jmp
+ /// handler...
+ ///
+ uc_context* ctx;
+
+ ///
+ /// unicorn-engine stack of the first instruction of the jmp handler...
+ ///
+ std::uint8_t* stack;
+ } m_jmp;
+
+ ///
+ /// vector of virtual instructions for this basic block...
+ ///
+ std::vector m_vinstrs;
+
+ ///
+ /// virtual branch type...
+ ///
+ vbranch_type branch_type;
+
+ ///
+ /// vector of virtual instruction pointers. one for each branch...
+ ///
+ std::vector branches;
+};
+
+///
+/// virtual routine structure
+///
+struct vrtn_t {
+ ///
+ /// relative virtual address to the first instruction of the vm enter...
+ ///
+ std::uint32_t m_rva;
+
+ ///
+ /// vector of virtual code blocks... these virtual code blocks contain virtual
+ /// instructions...
+ ///
+ std::vector m_blks;
+};
+
///
/// emu instruction containing current cpu register values and such...
///
struct emu_instr_t {
+ ///
+ /// decoded instruction...
+ ///
zydis_decoded_instr_t m_instr;
+
+ ///
+ /// cpu context before execution of this instruction...
+ ///
uc_context* m_cpu;
};
@@ -84,9 +180,30 @@ struct emu_instr_t {
/// contains some information about the virtual machine such as vip and vsp...
///
struct hndlr_trace_t {
- std::uintptr_t m_hndlr_addr;
+ ///
+ /// pointer to the unicorn-engine... used by profilers...
+ ///
uc_engine* m_uc;
- zydis_reg_t m_vip, m_vsp;
+
+ ///
+ /// copy of the stack at the very first instruction of the virtual machine
+ /// handler...
+ ///
+ std::uint8_t* m_stack;
+
+ ///
+ /// native register used for virtual instruction pointer...
+ ///
+ zydis_reg_t m_vip;
+
+ ///
+ /// native register used for the virtual stack pointer...
+ ///
+ zydis_reg_t m_vsp;
+
+ ///
+ /// vector of emulated, diassembled instructions...
+ ///
std::vector m_instrs;
};