MCPcopy Create free account
hub / github.com/connorjaydunn/BinaryShield / calculateEffectiveAddress

Function calculateEffectiveAddress

src/vm.cpp:659–783  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

657 }
658
659 void calculateEffectiveAddress(Instruction* instruction, ZydisDecodedOperandMem mem)
660 {
661 ZydisRegister base = mem.base;
662 ZydisRegister index = mem.index;
663 BYTE scale = mem.scale;
664 bool hasDisplacement = mem.disp.has_displacement;
665 long long displacement = mem.disp.value;
666
667 bool is64Bits = (base != ZYDIS_REGISTER_NONE && ZydisRegisterGetWidth(ZYDIS_MACHINE_MODE_LONG_64, base) == 64) ||
668 (index != ZYDIS_REGISTER_NONE && ZydisRegisterGetWidth(ZYDIS_MACHINE_MODE_LONG_64, index) == 64);
669
670 if (base == ZYDIS_REGISTER_RIP)
671 {
672 emitPushImmediate(instruction, instruction->getRva() + instruction->getInstructionInfo().length + displacement, 64);
673 emitPushRegister(instruction, R1, 64);
674 emitArithmetic(instruction, ZYDIS_MNEMONIC_ADD, 64);
675 emitPopRegister(instruction, R0, 64);
676 return;
677 }
678
679 if (base != ZYDIS_REGISTER_NONE)
680 {
681 if (base == ZYDIS_REGISTER_RSP)
682 {
683 emitPushRegister(instruction, ZYDIS_REGISTER_RSP, 64);
684 }
685 else
686 {
687 if (is64Bits)
688 {
689 emitPushRegister(instruction, base, 64);
690 }
691 else
692 {
693 emitPushRegister(instruction, base, 32);
694 }
695 }
696 }
697 else
698 {
699 if (is64Bits)
700 {
701 emitPushImmediate(instruction, 0x0, 64);
702 }
703 else
704 {
705 emitPushImmediate(instruction, 0x0, 32);
706 }
707 }
708
709 if (index != ZYDIS_REGISTER_NONE)
710 {
711 if (is64Bits)
712 {
713 emitPushRegister(instruction, index, 64);
714 }
715 else
716 {

Callers 4

x86PushHandlerFunction · 0.85
x86MovHandlerFunction · 0.85
x86LeaHandlerFunction · 0.85
x86ArithmeticHandlerFunction · 0.85

Calls 6

emitPushImmediateFunction · 0.85
emitPushRegisterFunction · 0.85
emitArithmeticFunction · 0.85
emitPopRegisterFunction · 0.85
getInstructionInfoMethod · 0.80
getRvaMethod · 0.45

Tested by

no test coverage detected