Closed Japrajah closed 3 months ago
Triton has function that disassembles memory block until reach control flow instruction , but I need function that stops dissasemble when "inst.back().isMemoryRead()" , or I need to stop on specific instruction's chain.
Somithing like this... /
architecture&context TRITON_EXPORT triton::arch::BasicBlock disassembly(triton::uint64 addr, bool(*cb)(std::vector<triton::arch::Instruction>&)) const { std::vector<triton::arch::Instruction> ret; do { if (!this->isConcreteMemoryValueDefined(addr)) { break; } auto opcodes = this->getConcreteMemoryAreaValue(addr, 16); auto inst = triton::arch::Instruction(addr, reinterpret_cast<triton::uint8*>(opcodes.data()), opcodes.size()); this->disassembly(inst); ret.push_back(inst); addr += inst.getSize(); } while (!cb(ret)); return triton::arch::BasicBlock(ret); }
architecture&context
TRITON_EXPORT triton::arch::BasicBlock disassembly(triton::uint64 addr, bool(*cb)(std::vector<triton::arch::Instruction>&)) const { std::vector<triton::arch::Instruction> ret; do { if (!this->isConcreteMemoryValueDefined(addr)) { break; } auto opcodes = this->getConcreteMemoryAreaValue(addr, 16); auto inst = triton::arch::Instruction(addr, reinterpret_cast<triton::uint8*>(opcodes.data()), opcodes.size()); this->disassembly(inst); ret.push_back(inst); addr += inst.getSize(); } while (!cb(ret)); return triton::arch::BasicBlock(ret); }
triton::arch::BasicBlock disassembly(triton::uint64 addr) const { return this->disassembly(addr, ([](std::vector& ret) {return ret.back().isControlFlow(); })); }
``` c // usage const auto dism_filter = [](std::vector<triton::arch::Instruction>& ret) -> bool { auto instr = ret.back().getDisassembly(); return instr.contains("[") && !instr.contains("rsp"); }; auto block = this->disassembly(address, dism_filter);
Can this be implemented?
It could be a great feature. Can you provide a PR for this one?
merged
Triton has function that disassembles memory block until reach control flow instruction , but I need function that stops dissasemble when "inst.back().isMemoryRead()" , or I need to stop on specific instruction's chain.
Somithing like this... /
triton::arch::BasicBlock disassembly(triton::uint64 addr) const { return this->disassembly(addr, ([](std::vector& ret) {return ret.back().isControlFlow(); }));
}
Can this be implemented?