Disassemble instructions from the address space of the process. @type lpAddress: int @param lpAddress: Memory address where to read the code from. @type dwSize: int @param dwSize: Size of binary code to disassemble. @rtype: list of tuple( long,
(self, lpAddress, dwSize)
| 538 | return disasm.decode(lpAddress, code) |
| 539 | |
| 540 | def disassemble(self, lpAddress, dwSize): |
| 541 | """ |
| 542 | Disassemble instructions from the address space of the process. |
| 543 | |
| 544 | @type lpAddress: int |
| 545 | @param lpAddress: Memory address where to read the code from. |
| 546 | |
| 547 | @type dwSize: int |
| 548 | @param dwSize: Size of binary code to disassemble. |
| 549 | |
| 550 | @rtype: list of tuple( long, int, str, str ) |
| 551 | @return: List of tuples. Each tuple represents an assembly instruction |
| 552 | and contains: |
| 553 | - Memory address of instruction. |
| 554 | - Size of instruction in bytes. |
| 555 | - Disassembly line of instruction. |
| 556 | - Hexadecimal dump of instruction. |
| 557 | """ |
| 558 | data = self.read(lpAddress, dwSize) |
| 559 | disasm = self.disassemble_string(lpAddress, data) |
| 560 | self.__fixup_labels(disasm) |
| 561 | return disasm |
| 562 | |
| 563 | # FIXME |
| 564 | # This algorithm really bad, I've got to write a better one :P |
no test coverage detected