diff --git a/trunk/ProcessHacker/Asm/AsmData.cs b/trunk/ProcessHacker/Asm/AsmData.cs index f13d9b4fc..1fa08803d 100644 --- a/trunk/ProcessHacker/Asm/AsmData.cs +++ b/trunk/ProcessHacker/Asm/AsmData.cs @@ -24,7 +24,7 @@ using System; using System.Collections.Generic; using System.Text; -namespace ProcessHacker.Asm +namespace ProcessHacker { public partial class Asm { diff --git a/trunk/ProcessHacker/Asm/AsmDefinitions.cs b/trunk/ProcessHacker/Asm/AsmDefinitions.cs index 78d7bafb1..8cbcae98c 100644 --- a/trunk/ProcessHacker/Asm/AsmDefinitions.cs +++ b/trunk/ProcessHacker/Asm/AsmDefinitions.cs @@ -24,7 +24,7 @@ using System; using System.Collections.Generic; using System.Text; -namespace ProcessHacker.Asm +namespace ProcessHacker { public partial class Asm { diff --git a/trunk/ProcessHacker/Asm/AsmMisc.cs b/trunk/ProcessHacker/Asm/AsmMisc.cs index 99e595727..5953b2861 100644 --- a/trunk/ProcessHacker/Asm/AsmMisc.cs +++ b/trunk/ProcessHacker/Asm/AsmMisc.cs @@ -24,7 +24,7 @@ using System; using System.Collections.Generic; using System.Text; -namespace ProcessHacker.Asm +namespace ProcessHacker { public unsafe partial class Asm { diff --git a/trunk/ProcessHacker/Asm/Disassembler.cs b/trunk/ProcessHacker/Asm/Disassembler.cs index afd7fff7f..c9a0b1f3c 100644 --- a/trunk/ProcessHacker/Asm/Disassembler.cs +++ b/trunk/ProcessHacker/Asm/Disassembler.cs @@ -24,7 +24,7 @@ using System; using System.Collections.Generic; using System.Text; -namespace ProcessHacker.Asm +namespace ProcessHacker { public unsafe partial class Asm { @@ -38,8 +38,6 @@ namespace ProcessHacker.Asm private int _dispSize; private int _immSize; private int _softError; - private int _nDump; - private int _nResult; private bool _addComment; private byte* _cmd; @@ -152,7 +150,7 @@ namespace ProcessHacker.Asm if ((PutDefSeg != 0 || seg != defSeg) && seg != SEG_UNDEF) pr += SegName[seg] + ":"; - if (!Ideal) + if (Ideal) pr += "["; pr += descr; @@ -440,7 +438,7 @@ namespace ProcessHacker.Asm else DecodeRG(c, regsize, type); - if (!memonly) + if (memonly) _softError = DAE_MEMORY; return; @@ -1132,15 +1130,15 @@ namespace ProcessHacker.Asm return (cond == 0) ? 1 : 0; } - public int Disasm(byte[] src, int srcsize, int srcIp, int disasmmode) + public int Disassemble(byte[] src, int srcsize, int srcIp, int disasmmode) { fixed (byte* pSrc = src) { - return Disasm(pSrc, srcsize, srcIp, disasmmode); + return Disassemble(pSrc, srcsize, srcIp, disasmmode); } } - public int Disasm(byte* src, int srcsize, int srcIp, int disasmmode) + public int Disassemble(byte* src, int srcsize, int srcIp, int disasmmode) { bool repeated, is3dnow; int searchi = 0; @@ -1160,8 +1158,6 @@ namespace ProcessHacker.Asm _dispSize = _immSize = 0; lockprefix = 0; repprefix = 0; - _nDump = 0; - _nResult = 0; _cmd = src; _size = srcsize; _pFixup = null; diff --git a/trunk/ProcessHacker/Forms/DisassemblyWindow.Designer.cs b/trunk/ProcessHacker/Forms/DisassemblyWindow.Designer.cs new file mode 100644 index 000000000..390cf636a --- /dev/null +++ b/trunk/ProcessHacker/Forms/DisassemblyWindow.Designer.cs @@ -0,0 +1,106 @@ +namespace ProcessHacker +{ + partial class DisassemblyWindow + { + /// + /// Required designer variable. + /// + private System.ComponentModel.IContainer components = null; + + /// + /// Clean up any resources being used. + /// + /// true if managed resources should be disposed; otherwise, false. + protected override void Dispose(bool disposing) + { + if (disposing && (components != null)) + { + components.Dispose(); + } + base.Dispose(disposing); + } + + #region Windows Form Designer generated code + + /// + /// Required method for Designer support - do not modify + /// the contents of this method with the code editor. + /// + private void InitializeComponent() + { + System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(DisassemblyWindow)); + this.listDisasm = new System.Windows.Forms.ListView(); + this.columnAddress = new System.Windows.Forms.ColumnHeader(); + this.columnRaw = new System.Windows.Forms.ColumnHeader(); + this.columnCode = new System.Windows.Forms.ColumnHeader(); + this.columnComment = new System.Windows.Forms.ColumnHeader(); + this.SuspendLayout(); + // + // listDisasm + // + this.listDisasm.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom) + | System.Windows.Forms.AnchorStyles.Left) + | System.Windows.Forms.AnchorStyles.Right))); + this.listDisasm.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { + this.columnAddress, + this.columnRaw, + this.columnCode, + this.columnComment}); + this.listDisasm.Font = new System.Drawing.Font("Lucida Console", 8.25F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(0))); + this.listDisasm.FullRowSelect = true; + this.listDisasm.GridLines = true; + this.listDisasm.HideSelection = false; + this.listDisasm.Location = new System.Drawing.Point(12, 12); + this.listDisasm.Name = "listDisasm"; + this.listDisasm.ShowItemToolTips = true; + this.listDisasm.Size = new System.Drawing.Size(498, 509); + this.listDisasm.TabIndex = 0; + this.listDisasm.UseCompatibleStateImageBehavior = false; + this.listDisasm.View = System.Windows.Forms.View.Details; + this.listDisasm.VirtualMode = true; + this.listDisasm.RetrieveVirtualItem += new System.Windows.Forms.RetrieveVirtualItemEventHandler(this.listDisasm_RetrieveVirtualItem); + // + // columnAddress + // + this.columnAddress.Text = "Address"; + this.columnAddress.Width = 80; + // + // columnRaw + // + this.columnRaw.Text = "Raw"; + this.columnRaw.Width = 100; + // + // columnCode + // + this.columnCode.Text = "Code"; + this.columnCode.Width = 140; + // + // columnComment + // + this.columnComment.Text = "Comment"; + this.columnComment.Width = 160; + // + // DisassemblyWindow + // + this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); + this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; + this.ClientSize = new System.Drawing.Size(522, 533); + this.Controls.Add(this.listDisasm); + this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.SizableToolWindow; + this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); + this.Name = "DisassemblyWindow"; + this.Text = "Disassembly"; + this.ResumeLayout(false); + + } + + #endregion + + private System.Windows.Forms.ListView listDisasm; + private System.Windows.Forms.ColumnHeader columnAddress; + private System.Windows.Forms.ColumnHeader columnRaw; + private System.Windows.Forms.ColumnHeader columnCode; + private System.Windows.Forms.ColumnHeader columnComment; + + } +} \ No newline at end of file diff --git a/trunk/ProcessHacker/Forms/DisassemblyWindow.cs b/trunk/ProcessHacker/Forms/DisassemblyWindow.cs new file mode 100644 index 000000000..c7692a9ad --- /dev/null +++ b/trunk/ProcessHacker/Forms/DisassemblyWindow.cs @@ -0,0 +1,54 @@ +using System; +using System.Collections.Generic; +using System.ComponentModel; +using System.Data; +using System.Drawing; +using System.Text; +using System.Windows.Forms; +using System.IO; + +namespace ProcessHacker +{ + public partial class DisassemblyWindow : Form + { + private List _disasm = new List(); + + public DisassemblyWindow(Stream s, long position, int maxCount) + { + InitializeComponent(); + + Asm.Disassembler disasm = new Asm.Disassembler(); + + s.Seek(position, SeekOrigin.Begin); + + while ((maxCount != -1 && _disasm.Count < maxCount) || (maxCount == -1)) + { + byte[] data = new byte[16]; + + s.Read(data, 0, 16); + s.Seek(disasm.Disassemble(data, 16, 0, Asm.DISASM_FILE) - 16, SeekOrigin.Current); + + _disasm.Add(new string[] + { + "0x" + s.Position.ToString("x8"), + disasm.Result.Dump.ToString(), + disasm.Result.Result.ToString(), + disasm.Result.Comment + }); + + if (maxCount == -1) + if (disasm.Result.Result.ToString().StartsWith("ret")) + break; + } + + listDisasm.VirtualListSize = _disasm.Count; + } + + private void listDisasm_RetrieveVirtualItem(object sender, RetrieveVirtualItemEventArgs e) + { + string[] item = _disasm[e.ItemIndex]; + + e.Item = new ListViewItem(item); + } + } +} diff --git a/trunk/ProcessHacker/Forms/DisassemblyWindow.resx b/trunk/ProcessHacker/Forms/DisassemblyWindow.resx new file mode 100644 index 000000000..ad4fc9d84 --- /dev/null +++ b/trunk/ProcessHacker/Forms/DisassemblyWindow.resx @@ -0,0 +1,145 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + + + AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAOrEo+vnv57/47uZ/+C2lP/dsY7/2a2J/9aohP/TpH7/0J96/82bdf/KmHH/yJVt/8WS + av/Dj2j/w49n/8OPZ+vuy6r/6NXI/+jUxP/n0sL/5dDA/+XOvf/jzLv/48q4/+LJtv/hx7T/4MSy/9/D + sP/fw6//3sGu/97Brf/Dj2f/8tCw/+rYzP/8/Pz/2rmj//z8/P/8/Pz//Pz8//z8/P/8/Pz//Pz8//z8 + /P/8/Pz/zKCB//z8/P/fwq//xJFp//XUtf/s3ND/3sKu/92+qv/bvKb/2bmi/9i2nv/Ws5v/1bCW/9Ot + k//Rqo7/0KeL/8+lh//NooT/4MSy/8eUbf/42Lr/7d7U//z8/P/8/Pz/3sGt//z8/P/bu6X//Pz8/9i1 + nf/8/Pz/1a+W//z8/P/8/Pz//Pz8/+HItf/KmHH/+ty+/+7g1v/jy7n/4sm3/+DFs//fw7D/3sGs/9y+ + qf/au6X/2bih/9e1nf/Wspn/6dbK//z8/P/jy7n/zpx2//zewP/v4tj//Pz8/+TMu//8/Pz/4cm2//z8 + /P/fwq///Pz8/9y9qP/8/Pz/2beg//z8/P/38/D/5c69/9GhfP/83sD/7+LY/+/i2P/v4tj/7uHX/+7g + 1v/u39T/7d3S/+zc0f/r2s7/6tjM/+rXyv/o1cf/59PE/+fRwf/Vp4L//N7A4/zewP+6uLX/srCt//rb + vf/42Lr/9tW2//PSsv/wzq3/7cmp/+rEo//nv57/47uZ/+C2lP/dsY7/2a2J4wAAAAAAAAAAw8PD/bu7 + u7SysrIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANDQ + 0PjJycn4wcHBZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AADZ2dln1NTU9s/Pz+/IyMjlv7+/2La2tsOtra2To6OjfZqamm6QkJBJhoaGBAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAA//+sQf//rEEAAKxBAACsQQAArEEAAKxBAACsQQAArEEAAKxBAACsQQAArEHH/6xBx/+sQcAH + rEH//6xB//+sQQ== + + + \ No newline at end of file diff --git a/trunk/ProcessHacker/Forms/PEWindow.Designer.cs b/trunk/ProcessHacker/Forms/PEWindow.Designer.cs index 6e40fedfc..0d52dc5df 100644 --- a/trunk/ProcessHacker/Forms/PEWindow.Designer.cs +++ b/trunk/ProcessHacker/Forms/PEWindow.Designer.cs @@ -308,6 +308,7 @@ this.listExports.UseCompatibleStateImageBehavior = false; this.listExports.View = System.Windows.Forms.View.Details; this.listExports.VirtualMode = true; + this.listExports.DoubleClick += new System.EventHandler(this.listExports_DoubleClick); this.listExports.RetrieveVirtualItem += new System.Windows.Forms.RetrieveVirtualItemEventHandler(this.listExports_RetrieveVirtualItem); // // columnExportName diff --git a/trunk/ProcessHacker/Forms/PEWindow.cs b/trunk/ProcessHacker/Forms/PEWindow.cs index 19f25fbc0..1deaea0d2 100644 --- a/trunk/ProcessHacker/Forms/PEWindow.cs +++ b/trunk/ProcessHacker/Forms/PEWindow.cs @@ -25,6 +25,7 @@ using System.Drawing; using System.Text; using System.Windows.Forms; using ProcessHacker.PE; +using System.IO; namespace ProcessHacker { @@ -349,5 +350,13 @@ namespace ProcessHacker } } } + + private void listExports_DoubleClick(object sender, EventArgs e) + { + DisassemblyWindow dw = new DisassemblyWindow(new FileStream(_path, FileMode.Open, FileAccess.Read), + PEFile.RvaToVa(_peFile, _peFile.ExportData.ExportAddressTable[listExports.SelectedIndices[0]].ExportRVA), -1); + + dw.Show(); + } } } diff --git a/trunk/ProcessHacker/Forms/PEWindow.resx b/trunk/ProcessHacker/Forms/PEWindow.resx index 84750b1af..38691eeef 100644 --- a/trunk/ProcessHacker/Forms/PEWindow.resx +++ b/trunk/ProcessHacker/Forms/PEWindow.resx @@ -127,19 +127,19 @@ AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj0yLjAuMC4w LCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACZTeXN0 - ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADK + ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADI AgAAAk1TRnQBSQFMAwEBAAEEAQABBAEAARABAAEQAQAE/wEhAQAI/wFCAU0BNgcAATYDAAEoAwABQAMA ARADAAEBAQABIAYAARD/AP8A/wD/AEIAAVYBVwFWAbgDBAEG9AADJgE4AVEBaQFRAfcBWwFeAVsB2dEA - Ab4BCQH/AQABuAEEAf8BAAGxAQAB/wEAAakBAAH/AQABoQEAAf8BAAGZAQAB/wEAAZEBAAH/AQABiAEA - Af8BAAGAAQAB/wEAAYgBAAH/AQABoQEAAf8BAAGLAQAB/wFZAVwBWQHPzAABAQHDAQ0B/wGgAdcBqQH/ - AZwB1QGlAf8BmAHTAaEB/wGUAdABnQH/AZABzgGYAf8BiwHLAZMB/wGHAckBjgH/AYIBxgGJAf8BGgHD - AYQB/wEWAcEBgAH/ARIBvgEYAf8BAAGMAQAB/wFZAVsBWQHEyAABBAHHARAB/wGlAdoBrgH/AaIB2AGr - Af8BngHWAacB/wGaAdQBowH/AZYB0gGfAf8BkwHPAZoB/wGOAcwBlQH/AYkBygGQAf8BhQHHAYsB/wGB - AcUBhwH/ARkBwgGCAf8BAAGRAQAB/wFZAVwBWQHJyAABBAHHARAB/wEEAccBEAH/AQEBwwENAf8BAAG+ - AQkB/wEAAbgBBAH/AQABsQEAAf8BAAGpAQAB/wEAAaEBAAH/AQABmQEAAf8BAAGRAQAB/wEAAaMBAAH/ - AQABnQEAAf8BWAFcAVgB0fQAAVEBbQFRAfcBWgFfAVoB2/gAAVYBWAFWAbsDBAEG/wD/AP8A/wDQAAFC - AU0BPgcAAT4DAAEoAwABQAMAARADAAEBAQABAQUAAYAXAAP/AQAC/wYAAv8GAAL/BgAC/wYAAf8B5wYA - Af8BxwYAAYABAwYAAYABAQYAAYABAQYAAYABAwYAAf8B5wYAAf8B5wYAAv8GAAL/BgAC/wYAAv8GAAs= + Ab4BBwH/AQABuAECAf8BAAGxAQAB/wEAAakBAAH/AQABoQEAAf8BAAGZAQAB/wEAAZEBAAH/AQABiAEA + Af8BAAGAAQAB/wEAAYgBAAH/AQABoQEAAf8BAAGLAQAB/wFZAVwBWQHPzQABwwELAf8BoAHXAakB/wGc + AdUBpQH/AZgB0wGhAf8BlAHQAZ0B/wGQAc4BmAH/AYsBywGTAf8BhwHJAY4B/wGCAcYBiQH/ARgBwwGE + Af8BFAHBAYAB/wEQAb4BFgH/AQABjAEAAf8BWQFbAVkBxMgAAQIBxwEOAf8BpQHaAa4B/wGiAdgBqwH/ + AZ4B1gGnAf8BmgHUAaMB/wGWAdIBnwH/AZMBzwGaAf8BjgHMAZUB/wGJAcoBkAH/AYUBxwGLAf8BgQHF + AYcB/wEXAcIBggH/AQABkQEAAf8BWQFcAVkBycgAAQIBxwEOAf8BAgHHAQ4B/wEAAcMBCwH/AQABvgEH + Af8BAAG4AQIB/wEAAbEBAAH/AQABqQEAAf8BAAGhAQAB/wEAAZkBAAH/AQABkQEAAf8BAAGjAQAB/wEA + AZ0BAAH/AVgBXAFYAdH0AAFRAW0BUQH3AVoBXwFaAdv4AAFWAVgBVgG7AwQBBv8A/wD/AP8A0AABQgFN + AT4HAAE+AwABKAMAAUADAAEQAwABAQEAAQEFAAGAFwAD/wEAAv8GAAL/BgAC/wYAAv8GAAH/AecGAAH/ + AccGAAGAAQMGAAGAAQEGAAGAAQEGAAGAAQMGAAH/AecGAAH/AecGAAL/BgAC/wYAAv8GAAL/BgAL diff --git a/trunk/ProcessHacker/Icons/Keyboard.ico b/trunk/ProcessHacker/Icons/Keyboard.ico new file mode 100644 index 000000000..5533d8b16 Binary files /dev/null and b/trunk/ProcessHacker/Icons/Keyboard.ico differ diff --git a/trunk/ProcessHacker/ProcessHacker.csproj b/trunk/ProcessHacker/ProcessHacker.csproj index df686228e..733e5fa96 100644 --- a/trunk/ProcessHacker/ProcessHacker.csproj +++ b/trunk/ProcessHacker/ProcessHacker.csproj @@ -141,6 +141,10 @@ AboutWindow.cs Designer + + DisassemblyWindow.cs + Designer + ErrorDialog.cs @@ -227,6 +231,12 @@ ProcessTree.cs + + Form + + + DisassemblyWindow.cs + Form