1

I am trying to write a plugin which, beside other things, would need to write assembly of some code segments into a file. Since the documentation is somewhat lacking I'm lost on some things and not sure how to use functions for disassembly. I'm reading commands with Readcommand function and then using Disasm function to get the assembly code but all I am getting is some gibberish. Also, in a help file it says that Readcommand function should return the actual size of instruction read, but it always returns maximum size. Any help on what I'm doing wrong or how to proceed to get the assembly code would be appreciated. Code with which I'm trying to get disassembly is located below.

code_length = Readcommand(reg->ip, cmd);
instruction_length = Disasm(cmd, code_length, reg->ip, dest, disasm, DISASM_ALL,thread_id);

4

ReadCommand() Returns bytes from internally cached buffer and returns atmost MAXCMDSIZE Bytes

the below snippet will take an address (HEX ONLY) read the command print the bytes and disassembly pertaining that address to log window take a look

void disasm( void) {
  ULONG data = 0;
  if((Getlong("enter address to disassemble",&data,4,0,DIA_HEXONLY)) != -1) {
    Addtolist(data,1,"eip provided is %x\n",data);
    char buff[MAXCMDSIZE+10] = {0};
    ULONG srcsize = 0;
    t_disasm mydisasm = {0};
  if((srcsize = Readcommand(data,buff)) !=0) {
    char pbuff[50] = {0};
    for (ulong i = 0;i<srcsize; i++){
      sprintf_s((char *)(pbuff+(i*2)),50,"%02x",*(char *)(buff+i));     
    }
    Addtolist(data,1,"command read %s size %x\n",pbuff,srcsize);
    Disasm((uchar *)buff,srcsize,data,NULL,&mydisasm,DISASM_ALL,NULL);
    Addtolist(data,1,"%s\n",mydisasm.result);
    }    
  }  
}
0

I've solved it. If anyone else will have same or similar problem, proper way to call Disasm function is (with cmd variable defined as in the question):

Disasm(cmd, code_length, reg->ip, DEC_UNKNOWN, DISASM_ALL, thread_id);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.