-
Notifications
You must be signed in to change notification settings - Fork 83
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
71 changed files
with
13,268 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
/* | ||
* MemorySharp Library | ||
* http://www.binarysharp.com/ | ||
* | ||
* Copyright (C) 2012-2016 Jämes Ménétrey (a.k.a. ZenLulz). | ||
* This library is released under the MIT License. | ||
* See the file LICENSE for more information. | ||
*/ | ||
|
||
namespace Binarysharp.MSharp.Assembly.Assembler | ||
{ | ||
/// <summary> | ||
/// Interface defining an assembler. | ||
/// </summary> | ||
public interface IAssembler | ||
{ | ||
/// <summary> | ||
/// Assemble the specified assembly code. | ||
/// </summary> | ||
/// <param name="instructions">The instructions represented in assembly code.</param> | ||
/// <returns>An array of bytes containing the assembly code.</returns> | ||
byte[] Assemble(IEnumerable<string> instructions); | ||
|
||
/// <summary> | ||
/// Assemble the specified assembly code at a base address. | ||
/// </summary> | ||
/// <param name="instructions">The instructions represented in assembly code.</param> | ||
/// <param name="baseAddress">The address where the code is rebased.</param> | ||
/// <returns>An array of bytes containing the assembly code.</returns> | ||
byte[] Assemble(IEnumerable<string> instructions, IntPtr baseAddress); | ||
} | ||
} |
81 changes: 81 additions & 0 deletions
81
Binarysharp.MSharp/Assembly/Assembler/KeystoneAssembler.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,81 @@ | ||
using Binarysharp.MSharp.Memory; | ||
using Keystone; | ||
|
||
namespace Binarysharp.MSharp.Assembly.Assembler | ||
{ | ||
/// <summary> | ||
/// Rely on Keystone assembler. | ||
/// More info: https://github.com/keystone-engine/keystone | ||
/// </summary> | ||
public class KeystoneAssembler : IAssembler | ||
{ | ||
#region Fields | ||
|
||
private static readonly Dictionary<InstructionSet, Mode> ModeMappings = new Dictionary<InstructionSet, Mode> | ||
{ | ||
{ InstructionSet.X64, Mode.X64 }, | ||
{ InstructionSet.X86, Mode.X32 } | ||
}; | ||
|
||
/// <summary> | ||
/// The instance of Keystone engine. | ||
/// </summary> | ||
private readonly Engine _assembler; | ||
|
||
#endregion | ||
|
||
#region Constructor | ||
|
||
/// <summary> | ||
/// Creates a new instance of the assembler. | ||
/// The instruction set matches the architecture of the target process. | ||
/// </summary> | ||
public KeystoneAssembler(InstructionSet instructionSet) | ||
{ | ||
_assembler = new Engine(Architecture.X86, MapToKeystoneMode(instructionSet)) { ThrowOnError = true }; | ||
} | ||
|
||
#endregion | ||
|
||
#region Implementation of IAssembler | ||
|
||
/// <summary> | ||
/// Assemble the specified assembly code. | ||
/// </summary> | ||
/// <param name="instructions">The instructions represented in assembly code.</param> | ||
/// <returns>An array of bytes containing the assembly code.</returns> | ||
public byte[] Assemble(IEnumerable<string> instructions) => Assemble(instructions, IntPtr.Zero); | ||
|
||
/// <summary> | ||
/// Assemble the specified assembly code at a base address. | ||
/// </summary> | ||
/// <param name="instructions">The instructions represented in assembly code.</param> | ||
/// <param name="baseAddress">The address where the code is rebased.</param> | ||
/// <returns>An array of bytes containing the assembly code.</returns> | ||
public byte[] Assemble(IEnumerable<string> instructions, IntPtr baseAddress) | ||
{ | ||
return _assembler.Assemble(string.Join(";", instructions), (ulong) baseAddress.ToInt64()).Buffer; | ||
} | ||
|
||
#endregion | ||
|
||
#region Private Methods | ||
|
||
/// <summary> | ||
/// Converts an instruction set enumeration from MemorySharp to a mode from Keystone. | ||
/// </summary> | ||
/// <param name="instructionSet"></param> | ||
/// <returns></returns> | ||
private Mode MapToKeystoneMode(InstructionSet instructionSet) | ||
{ | ||
if (ModeMappings.TryGetValue(instructionSet, out Mode mode)) | ||
{ | ||
return mode; | ||
} | ||
|
||
throw new ArgumentException("The instruction set is not supported", nameof(instructionSet)); | ||
} | ||
|
||
#endregion | ||
} | ||
} |
Oops, something went wrong.