Method DisassembleBytes

ReClass/CNodeFunctionPtr.cpp:192–309

}

void CNodeFunctionPtr::DisassembleBytes( ULONG_PTR Address )
{
	UCHAR Code[2048] = { 0xCC }; // max function length
	UIntPtr VirtualAddress = Address;

	// Clear old disassembly info
	m_pAssemblyWindow->SetReadOnly( FALSE );
	m_pAssemblyWindow->Clear( );
	m_pAssemblyWindow->SetReadOnly( TRUE );

	m_Assembly.clear( );
	m_nLongestLine = 0;

	// Read in process bytes
	if (ReClassReadMemory( (LPVOID)VirtualAddress, (LPVOID)&VirtualAddress, sizeof( UIntPtr ) ) && 
        ReClassReadMemory( (LPVOID)VirtualAddress, (LPVOID)Code, 2048 ))
	{
		DISASM MyDisasm;
		BOOL Error = FALSE;
		UIntPtr EndCodeSection = (UIntPtr)(Code + 2048);

		ZeroMemory( &MyDisasm, sizeof( DISASM ) );
		MyDisasm.EIP = (UIntPtr)Code;
		MyDisasm.VirtualAddr = (UInt64)VirtualAddress;
		#ifdef _WIN64
		MyDisasm.Archi = 64;
		#else
		MyDisasm.Archi = 0;
		#endif
		MyDisasm.Options = MasmSyntax | PrefixedNumeral | ShowSegmentRegs;

		// Get assembly lines
		while (Error == FALSE)
		{
			int disasmLen = 0;

			MyDisasm.SecurityBlock = (UInt32)(EndCodeSection - MyDisasm.EIP);

			disasmLen = Disasm( &MyDisasm );
			if (disasmLen == OUT_OF_BLOCK || disasmLen == UNKNOWN_OPCODE)
			{
				Error = TRUE;
			}
			else
			{
				CHAR szInstruction[256] = { 0 };
				CHAR szBytes[128] = { 0 };

				// INT3 instruction usually indicates the end of a function
				if (MyDisasm.Instruction.Opcode == 0xCC)
					break;

				// Generate instruction bytes
				for (int i = 0; i < disasmLen; i++)
				{
					CHAR szByte[8];
					sprintf_s( szByte, "%02X ", *(UCHAR*)(MyDisasm.EIP + i) );
					strcat_s( szBytes, szByte );