diff --git a/trunk/ProcessHacker/Asm/AsmData.cs b/trunk/ProcessHacker/Asm/AsmData.cs
index f13d9b4fc..1fa08803d 100644
--- a/trunk/ProcessHacker/Asm/AsmData.cs
+++ b/trunk/ProcessHacker/Asm/AsmData.cs
@@ -24,7 +24,7 @@ using System;
using System.Collections.Generic;
using System.Text;
-namespace ProcessHacker.Asm
+namespace ProcessHacker
{
public partial class Asm
{
diff --git a/trunk/ProcessHacker/Asm/AsmDefinitions.cs b/trunk/ProcessHacker/Asm/AsmDefinitions.cs
index 78d7bafb1..8cbcae98c 100644
--- a/trunk/ProcessHacker/Asm/AsmDefinitions.cs
+++ b/trunk/ProcessHacker/Asm/AsmDefinitions.cs
@@ -24,7 +24,7 @@ using System;
using System.Collections.Generic;
using System.Text;
-namespace ProcessHacker.Asm
+namespace ProcessHacker
{
public partial class Asm
{
diff --git a/trunk/ProcessHacker/Asm/AsmMisc.cs b/trunk/ProcessHacker/Asm/AsmMisc.cs
index 99e595727..5953b2861 100644
--- a/trunk/ProcessHacker/Asm/AsmMisc.cs
+++ b/trunk/ProcessHacker/Asm/AsmMisc.cs
@@ -24,7 +24,7 @@ using System;
using System.Collections.Generic;
using System.Text;
-namespace ProcessHacker.Asm
+namespace ProcessHacker
{
public unsafe partial class Asm
{
diff --git a/trunk/ProcessHacker/Asm/Disassembler.cs b/trunk/ProcessHacker/Asm/Disassembler.cs
index afd7fff7f..c9a0b1f3c 100644
--- a/trunk/ProcessHacker/Asm/Disassembler.cs
+++ b/trunk/ProcessHacker/Asm/Disassembler.cs
@@ -24,7 +24,7 @@ using System;
using System.Collections.Generic;
using System.Text;
-namespace ProcessHacker.Asm
+namespace ProcessHacker
{
public unsafe partial class Asm
{
@@ -38,8 +38,6 @@ namespace ProcessHacker.Asm
private int _dispSize;
private int _immSize;
private int _softError;
- private int _nDump;
- private int _nResult;
private bool _addComment;
private byte* _cmd;
@@ -152,7 +150,7 @@ namespace ProcessHacker.Asm
if ((PutDefSeg != 0 || seg != defSeg) && seg != SEG_UNDEF)
pr += SegName[seg] + ":";
- if (!Ideal)
+ if (Ideal)
pr += "[";
pr += descr;
@@ -440,7 +438,7 @@ namespace ProcessHacker.Asm
else
DecodeRG(c, regsize, type);
- if (!memonly)
+ if (memonly)
_softError = DAE_MEMORY;
return;
@@ -1132,15 +1130,15 @@ namespace ProcessHacker.Asm
return (cond == 0) ? 1 : 0;
}
- public int Disasm(byte[] src, int srcsize, int srcIp, int disasmmode)
+ public int Disassemble(byte[] src, int srcsize, int srcIp, int disasmmode)
{
fixed (byte* pSrc = src)
{
- return Disasm(pSrc, srcsize, srcIp, disasmmode);
+ return Disassemble(pSrc, srcsize, srcIp, disasmmode);
}
}
- public int Disasm(byte* src, int srcsize, int srcIp, int disasmmode)
+ public int Disassemble(byte* src, int srcsize, int srcIp, int disasmmode)
{
bool repeated, is3dnow;
int searchi = 0;
@@ -1160,8 +1158,6 @@ namespace ProcessHacker.Asm
_dispSize = _immSize = 0;
lockprefix = 0;
repprefix = 0;
- _nDump = 0;
- _nResult = 0;
_cmd = src;
_size = srcsize;
_pFixup = null;
diff --git a/trunk/ProcessHacker/Forms/DisassemblyWindow.Designer.cs b/trunk/ProcessHacker/Forms/DisassemblyWindow.Designer.cs
new file mode 100644
index 000000000..390cf636a
--- /dev/null
+++ b/trunk/ProcessHacker/Forms/DisassemblyWindow.Designer.cs
@@ -0,0 +1,106 @@
+namespace ProcessHacker
+{
+ partial class DisassemblyWindow
+ {
+ ///
+ /// Required designer variable.
+ ///
+ private System.ComponentModel.IContainer components = null;
+
+ ///
+ /// Clean up any resources being used.
+ ///
+ /// true if managed resources should be disposed; otherwise, false.
+ protected override void Dispose(bool disposing)
+ {
+ if (disposing && (components != null))
+ {
+ components.Dispose();
+ }
+ base.Dispose(disposing);
+ }
+
+ #region Windows Form Designer generated code
+
+ ///
+ /// Required method for Designer support - do not modify
+ /// the contents of this method with the code editor.
+ ///
+ private void InitializeComponent()
+ {
+ System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(DisassemblyWindow));
+ this.listDisasm = new System.Windows.Forms.ListView();
+ this.columnAddress = new System.Windows.Forms.ColumnHeader();
+ this.columnRaw = new System.Windows.Forms.ColumnHeader();
+ this.columnCode = new System.Windows.Forms.ColumnHeader();
+ this.columnComment = new System.Windows.Forms.ColumnHeader();
+ this.SuspendLayout();
+ //
+ // listDisasm
+ //
+ this.listDisasm.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom)
+ | System.Windows.Forms.AnchorStyles.Left)
+ | System.Windows.Forms.AnchorStyles.Right)));
+ this.listDisasm.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] {
+ this.columnAddress,
+ this.columnRaw,
+ this.columnCode,
+ this.columnComment});
+ this.listDisasm.Font = new System.Drawing.Font("Lucida Console", 8.25F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(0)));
+ this.listDisasm.FullRowSelect = true;
+ this.listDisasm.GridLines = true;
+ this.listDisasm.HideSelection = false;
+ this.listDisasm.Location = new System.Drawing.Point(12, 12);
+ this.listDisasm.Name = "listDisasm";
+ this.listDisasm.ShowItemToolTips = true;
+ this.listDisasm.Size = new System.Drawing.Size(498, 509);
+ this.listDisasm.TabIndex = 0;
+ this.listDisasm.UseCompatibleStateImageBehavior = false;
+ this.listDisasm.View = System.Windows.Forms.View.Details;
+ this.listDisasm.VirtualMode = true;
+ this.listDisasm.RetrieveVirtualItem += new System.Windows.Forms.RetrieveVirtualItemEventHandler(this.listDisasm_RetrieveVirtualItem);
+ //
+ // columnAddress
+ //
+ this.columnAddress.Text = "Address";
+ this.columnAddress.Width = 80;
+ //
+ // columnRaw
+ //
+ this.columnRaw.Text = "Raw";
+ this.columnRaw.Width = 100;
+ //
+ // columnCode
+ //
+ this.columnCode.Text = "Code";
+ this.columnCode.Width = 140;
+ //
+ // columnComment
+ //
+ this.columnComment.Text = "Comment";
+ this.columnComment.Width = 160;
+ //
+ // DisassemblyWindow
+ //
+ this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F);
+ this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font;
+ this.ClientSize = new System.Drawing.Size(522, 533);
+ this.Controls.Add(this.listDisasm);
+ this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.SizableToolWindow;
+ this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon")));
+ this.Name = "DisassemblyWindow";
+ this.Text = "Disassembly";
+ this.ResumeLayout(false);
+
+ }
+
+ #endregion
+
+ private System.Windows.Forms.ListView listDisasm;
+ private System.Windows.Forms.ColumnHeader columnAddress;
+ private System.Windows.Forms.ColumnHeader columnRaw;
+ private System.Windows.Forms.ColumnHeader columnCode;
+ private System.Windows.Forms.ColumnHeader columnComment;
+
+ }
+}
\ No newline at end of file
diff --git a/trunk/ProcessHacker/Forms/DisassemblyWindow.cs b/trunk/ProcessHacker/Forms/DisassemblyWindow.cs
new file mode 100644
index 000000000..c7692a9ad
--- /dev/null
+++ b/trunk/ProcessHacker/Forms/DisassemblyWindow.cs
@@ -0,0 +1,54 @@
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Data;
+using System.Drawing;
+using System.Text;
+using System.Windows.Forms;
+using System.IO;
+
+namespace ProcessHacker
+{
+ public partial class DisassemblyWindow : Form
+ {
+ private List _disasm = new List();
+
+ public DisassemblyWindow(Stream s, long position, int maxCount)
+ {
+ InitializeComponent();
+
+ Asm.Disassembler disasm = new Asm.Disassembler();
+
+ s.Seek(position, SeekOrigin.Begin);
+
+ while ((maxCount != -1 && _disasm.Count < maxCount) || (maxCount == -1))
+ {
+ byte[] data = new byte[16];
+
+ s.Read(data, 0, 16);
+ s.Seek(disasm.Disassemble(data, 16, 0, Asm.DISASM_FILE) - 16, SeekOrigin.Current);
+
+ _disasm.Add(new string[]
+ {
+ "0x" + s.Position.ToString("x8"),
+ disasm.Result.Dump.ToString(),
+ disasm.Result.Result.ToString(),
+ disasm.Result.Comment
+ });
+
+ if (maxCount == -1)
+ if (disasm.Result.Result.ToString().StartsWith("ret"))
+ break;
+ }
+
+ listDisasm.VirtualListSize = _disasm.Count;
+ }
+
+ private void listDisasm_RetrieveVirtualItem(object sender, RetrieveVirtualItemEventArgs e)
+ {
+ string[] item = _disasm[e.ItemIndex];
+
+ e.Item = new ListViewItem(item);
+ }
+ }
+}
diff --git a/trunk/ProcessHacker/Forms/DisassemblyWindow.resx b/trunk/ProcessHacker/Forms/DisassemblyWindow.resx
new file mode 100644
index 000000000..ad4fc9d84
--- /dev/null
+++ b/trunk/ProcessHacker/Forms/DisassemblyWindow.resx
@@ -0,0 +1,145 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/microsoft-resx
+
+
+ 2.0
+
+
+ System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
+
+
+ System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
+
+
+
+
+ AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAOrEo+vnv57/47uZ/+C2lP/dsY7/2a2J/9aohP/TpH7/0J96/82bdf/KmHH/yJVt/8WS
+ av/Dj2j/w49n/8OPZ+vuy6r/6NXI/+jUxP/n0sL/5dDA/+XOvf/jzLv/48q4/+LJtv/hx7T/4MSy/9/D
+ sP/fw6//3sGu/97Brf/Dj2f/8tCw/+rYzP/8/Pz/2rmj//z8/P/8/Pz//Pz8//z8/P/8/Pz//Pz8//z8
+ /P/8/Pz/zKCB//z8/P/fwq//xJFp//XUtf/s3ND/3sKu/92+qv/bvKb/2bmi/9i2nv/Ws5v/1bCW/9Ot
+ k//Rqo7/0KeL/8+lh//NooT/4MSy/8eUbf/42Lr/7d7U//z8/P/8/Pz/3sGt//z8/P/bu6X//Pz8/9i1
+ nf/8/Pz/1a+W//z8/P/8/Pz//Pz8/+HItf/KmHH/+ty+/+7g1v/jy7n/4sm3/+DFs//fw7D/3sGs/9y+
+ qf/au6X/2bih/9e1nf/Wspn/6dbK//z8/P/jy7n/zpx2//zewP/v4tj//Pz8/+TMu//8/Pz/4cm2//z8
+ /P/fwq///Pz8/9y9qP/8/Pz/2beg//z8/P/38/D/5c69/9GhfP/83sD/7+LY/+/i2P/v4tj/7uHX/+7g
+ 1v/u39T/7d3S/+zc0f/r2s7/6tjM/+rXyv/o1cf/59PE/+fRwf/Vp4L//N7A4/zewP+6uLX/srCt//rb
+ vf/42Lr/9tW2//PSsv/wzq3/7cmp/+rEo//nv57/47uZ/+C2lP/dsY7/2a2J4wAAAAAAAAAAw8PD/bu7
+ u7SysrIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANDQ
+ 0PjJycn4wcHBZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AADZ2dln1NTU9s/Pz+/IyMjlv7+/2La2tsOtra2To6OjfZqamm6QkJBJhoaGBAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAA//+sQf//rEEAAKxBAACsQQAArEEAAKxBAACsQQAArEEAAKxBAACsQQAArEHH/6xBx/+sQcAH
+ rEH//6xB//+sQQ==
+
+
+
\ No newline at end of file
diff --git a/trunk/ProcessHacker/Forms/PEWindow.Designer.cs b/trunk/ProcessHacker/Forms/PEWindow.Designer.cs
index 6e40fedfc..0d52dc5df 100644
--- a/trunk/ProcessHacker/Forms/PEWindow.Designer.cs
+++ b/trunk/ProcessHacker/Forms/PEWindow.Designer.cs
@@ -308,6 +308,7 @@
this.listExports.UseCompatibleStateImageBehavior = false;
this.listExports.View = System.Windows.Forms.View.Details;
this.listExports.VirtualMode = true;
+ this.listExports.DoubleClick += new System.EventHandler(this.listExports_DoubleClick);
this.listExports.RetrieveVirtualItem += new System.Windows.Forms.RetrieveVirtualItemEventHandler(this.listExports_RetrieveVirtualItem);
//
// columnExportName
diff --git a/trunk/ProcessHacker/Forms/PEWindow.cs b/trunk/ProcessHacker/Forms/PEWindow.cs
index 19f25fbc0..1deaea0d2 100644
--- a/trunk/ProcessHacker/Forms/PEWindow.cs
+++ b/trunk/ProcessHacker/Forms/PEWindow.cs
@@ -25,6 +25,7 @@ using System.Drawing;
using System.Text;
using System.Windows.Forms;
using ProcessHacker.PE;
+using System.IO;
namespace ProcessHacker
{
@@ -349,5 +350,13 @@ namespace ProcessHacker
}
}
}
+
+ private void listExports_DoubleClick(object sender, EventArgs e)
+ {
+ DisassemblyWindow dw = new DisassemblyWindow(new FileStream(_path, FileMode.Open, FileAccess.Read),
+ PEFile.RvaToVa(_peFile, _peFile.ExportData.ExportAddressTable[listExports.SelectedIndices[0]].ExportRVA), -1);
+
+ dw.Show();
+ }
}
}
diff --git a/trunk/ProcessHacker/Forms/PEWindow.resx b/trunk/ProcessHacker/Forms/PEWindow.resx
index 84750b1af..38691eeef 100644
--- a/trunk/ProcessHacker/Forms/PEWindow.resx
+++ b/trunk/ProcessHacker/Forms/PEWindow.resx
@@ -127,19 +127,19 @@
AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj0yLjAuMC4w
LCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACZTeXN0
- ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADK
+ ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADI
AgAAAk1TRnQBSQFMAwEBAAEEAQABBAEAARABAAEQAQAE/wEhAQAI/wFCAU0BNgcAATYDAAEoAwABQAMA
ARADAAEBAQABIAYAARD/AP8A/wD/AEIAAVYBVwFWAbgDBAEG9AADJgE4AVEBaQFRAfcBWwFeAVsB2dEA
- Ab4BCQH/AQABuAEEAf8BAAGxAQAB/wEAAakBAAH/AQABoQEAAf8BAAGZAQAB/wEAAZEBAAH/AQABiAEA
- Af8BAAGAAQAB/wEAAYgBAAH/AQABoQEAAf8BAAGLAQAB/wFZAVwBWQHPzAABAQHDAQ0B/wGgAdcBqQH/
- AZwB1QGlAf8BmAHTAaEB/wGUAdABnQH/AZABzgGYAf8BiwHLAZMB/wGHAckBjgH/AYIBxgGJAf8BGgHD
- AYQB/wEWAcEBgAH/ARIBvgEYAf8BAAGMAQAB/wFZAVsBWQHEyAABBAHHARAB/wGlAdoBrgH/AaIB2AGr
- Af8BngHWAacB/wGaAdQBowH/AZYB0gGfAf8BkwHPAZoB/wGOAcwBlQH/AYkBygGQAf8BhQHHAYsB/wGB
- AcUBhwH/ARkBwgGCAf8BAAGRAQAB/wFZAVwBWQHJyAABBAHHARAB/wEEAccBEAH/AQEBwwENAf8BAAG+
- AQkB/wEAAbgBBAH/AQABsQEAAf8BAAGpAQAB/wEAAaEBAAH/AQABmQEAAf8BAAGRAQAB/wEAAaMBAAH/
- AQABnQEAAf8BWAFcAVgB0fQAAVEBbQFRAfcBWgFfAVoB2/gAAVYBWAFWAbsDBAEG/wD/AP8A/wDQAAFC
- AU0BPgcAAT4DAAEoAwABQAMAARADAAEBAQABAQUAAYAXAAP/AQAC/wYAAv8GAAL/BgAC/wYAAf8B5wYA
- Af8BxwYAAYABAwYAAYABAQYAAYABAQYAAYABAwYAAf8B5wYAAf8B5wYAAv8GAAL/BgAC/wYAAv8GAAs=
+ Ab4BBwH/AQABuAECAf8BAAGxAQAB/wEAAakBAAH/AQABoQEAAf8BAAGZAQAB/wEAAZEBAAH/AQABiAEA
+ Af8BAAGAAQAB/wEAAYgBAAH/AQABoQEAAf8BAAGLAQAB/wFZAVwBWQHPzQABwwELAf8BoAHXAakB/wGc
+ AdUBpQH/AZgB0wGhAf8BlAHQAZ0B/wGQAc4BmAH/AYsBywGTAf8BhwHJAY4B/wGCAcYBiQH/ARgBwwGE
+ Af8BFAHBAYAB/wEQAb4BFgH/AQABjAEAAf8BWQFbAVkBxMgAAQIBxwEOAf8BpQHaAa4B/wGiAdgBqwH/
+ AZ4B1gGnAf8BmgHUAaMB/wGWAdIBnwH/AZMBzwGaAf8BjgHMAZUB/wGJAcoBkAH/AYUBxwGLAf8BgQHF
+ AYcB/wEXAcIBggH/AQABkQEAAf8BWQFcAVkBycgAAQIBxwEOAf8BAgHHAQ4B/wEAAcMBCwH/AQABvgEH
+ Af8BAAG4AQIB/wEAAbEBAAH/AQABqQEAAf8BAAGhAQAB/wEAAZkBAAH/AQABkQEAAf8BAAGjAQAB/wEA
+ AZ0BAAH/AVgBXAFYAdH0AAFRAW0BUQH3AVoBXwFaAdv4AAFWAVgBVgG7AwQBBv8A/wD/AP8A0AABQgFN
+ AT4HAAE+AwABKAMAAUADAAEQAwABAQEAAQEFAAGAFwAD/wEAAv8GAAL/BgAC/wYAAv8GAAH/AecGAAH/
+ AccGAAGAAQMGAAGAAQEGAAGAAQEGAAGAAQMGAAH/AecGAAH/AecGAAL/BgAC/wYAAv8GAAL/BgAL
diff --git a/trunk/ProcessHacker/Icons/Keyboard.ico b/trunk/ProcessHacker/Icons/Keyboard.ico
new file mode 100644
index 000000000..5533d8b16
Binary files /dev/null and b/trunk/ProcessHacker/Icons/Keyboard.ico differ
diff --git a/trunk/ProcessHacker/ProcessHacker.csproj b/trunk/ProcessHacker/ProcessHacker.csproj
index df686228e..733e5fa96 100644
--- a/trunk/ProcessHacker/ProcessHacker.csproj
+++ b/trunk/ProcessHacker/ProcessHacker.csproj
@@ -141,6 +141,10 @@
AboutWindow.cs
Designer
+
+ DisassemblyWindow.cs
+ Designer
+
ErrorDialog.cs
@@ -227,6 +231,12 @@
ProcessTree.cs
+
+ Form
+
+
+ DisassemblyWindow.cs
+
Form