Skip to content

Commit 57e57d5

Browse files
BeneficialCodeBeneficialCode
committed
Added the Disassembler.
1 parent 78fdf4c commit 57e57d5

File tree

11 files changed

+677
-15
lines changed

11 files changed

+677
-15
lines changed

‎WinArk/DisasmDlg.cpp‎

Lines changed: 413 additions & 0 deletions
Large diffs are not rendered by default.

‎WinArk/DisasmDlg.h‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
#pragma once
2+
#include "resource.h"
3+
#include "HexEdit.h"
4+
#include "ApiReader.h"
5+
6+
enum DisasmAddressType {
7+
ADDRESS_TYPE_MODULE,
8+
ADDRESS_TYPE_API,
9+
ADDRESS_TYPE_SPECIAL
10+
};
11+
12+
class DisasmAddressComment {
13+
public:
14+
DWORD_PTR _address;
15+
WCHAR _comment[512];
16+
DisasmAddressType _type;
17+
DWORD _moduleSize;
18+
19+
bool operator<(const DisasmAddressComment& rhs) {
20+
return _address < rhs._address;
21+
}
22+
};
23+
24+
class CDisasmDlg :public CDialogImpl<CDisasmDlg>,
25+
public CWinDataExchange<CDisasmDlg>, public CDialogResize<CDisasmDlg> {
26+
public:
27+
enum {IDD = IDD_DISASSEMBLER};
28+
29+
CDisasmDlg(DWORD_PTR startAddress, ApiReader* _pApiReader);
30+
31+
protected:
32+
static const size_t DISASM_SIZE = 0x1000;
33+
WCHAR _temp[512];
34+
int _addressHistoryIndex = 0;
35+
36+
std::vector<DWORD_PTR> _addressHistories;
37+
std::vector<DisasmAddressComment> _addressComments;
38+
39+
CListViewCtrl _ListDisassembler;
40+
CHexEdit _address;
41+
42+
enum DisasmColumns {
43+
Address = 0,
44+
InstructionSize,
45+
Opcodes,
46+
Instruction,
47+
Comment
48+
};
49+
50+
CMenu _hMenuDisasm;
51+
52+
BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);
53+
void OnContextMenu(CWindow wnd, CPoint point);
54+
void OnExit(UINT uNotifyCode, int nID, CWindow wndCtl);
55+
LRESULT OnNMCustomdraw(NMHDR* pnmh);
56+
void OnDisassemble(UINT uNotifyCode, int nID, CWindow wndCtl);
57+
void OnDisassembleBack(UINT uNotifyCode, int nID, CWindow wndCtl);
58+
void OnDisassembleForward(UINT uNotifyCode, int nID, CWindow wndCtl);
59+
60+
void AddColumnsToDisassembler(CListViewCtrl& list);
61+
bool DisplayDisassembly();
62+
63+
void CopyToClipboard(const WCHAR* pText);
64+
65+
private:
66+
ApiReader* _pApiReader = nullptr;
67+
BYTE _data[DISASM_SIZE];
68+
69+
void ToUpperCase(WCHAR* pLowercase);
70+
void DoColorInstruction(LPNMLVCUSTOMDRAW lpLVCustomDraw, DWORD_PTR itemIndex);
71+
void FollowInstruction(int index);
72+
bool GetDisassemblyComment(unsigned int index);
73+
74+
void DisassembleNewAddress(DWORD_PTR address);
75+
void InitAddressCommentList();
76+
void AddModuleAddressCommentEntry(DWORD_PTR address, DWORD moduleSize, const WCHAR* pModulePath);
77+
void AnalyzeAddress(DWORD_PTR address, WCHAR* pComment);
78+
79+
public:
80+
BEGIN_DDX_MAP(CDisasmDlg)
81+
DDX_CONTROL_HANDLE(IDC_LIST_DISASSEMBLER,_ListDisassembler)
82+
DDX_CONTROL(IDC_DISASM_ADDRESS,_address)
83+
END_DDX_MAP()
84+
85+
BEGIN_MSG_MAP(CDisasmDlg)
86+
MSG_WM_INITDIALOG(OnInitDialog)
87+
MSG_WM_CONTEXTMENU(OnContextMenu)
88+
89+
NOTIFY_HANDLER_EX(IDC_LIST_DISASSEMBLER,NM_CUSTOMDRAW,OnNMCustomdraw)
90+
91+
COMMAND_ID_HANDLER_EX(IDC_DISASM,OnDisassemble)
92+
COMMAND_ID_HANDLER_EX(IDC_DISASM_BACK,OnDisassembleBack)
93+
COMMAND_ID_HANDLER_EX(IDC_DISASM_FORWARD,OnDisassembleForward)
94+
COMMAND_ID_HANDLER_EX(IDCANCEL,OnExit)
95+
COMMAND_ID_HANDLER_EX(IDOK,OnExit)
96+
CHAIN_MSG_MAP(CDialogResize<CDisasmDlg>)
97+
END_MSG_MAP()
98+
99+
BEGIN_DLGRESIZE_MAP(CDisasmDlg)
100+
DLGRESIZE_CONTROL(IDC_LIST_DISASSEMBLER, DLSZ_SIZE_X | DLSZ_SIZE_Y)
101+
DLGRESIZE_CONTROL(IDC_DISASM, DLSZ_MOVE_X | DLSZ_MOVE_Y)
102+
DLGRESIZE_CONTROL(IDC_DISASM_BACK, DLSZ_MOVE_X | DLSZ_MOVE_Y)
103+
DLGRESIZE_CONTROL(IDC_DISASM_FORWARD, DLSZ_MOVE_X | DLSZ_MOVE_Y)
104+
DLGRESIZE_CONTROL(IDC_DISASM_ADDRESS, DLSZ_MOVE_Y)
105+
DLGRESIZE_CONTROL(IDC_DISASSEMBLE_ADDRESS, DLSZ_MOVE_Y)
106+
END_DLGRESIZE_MAP()
107+
};

‎WinArk/HexEdit.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
#pragma once
22

33

4-
class CHexEdit : public CWindowImpl<CHexEdit, CEdit>
4+
class CHexEdit : public CWindowImpl<CHexEdit, CEdit, CControlWinTraits>
55
{
66
public:
7+
DECLARE_WND_CLASS(L"WTL_HexEdit")
8+
79
static const short int _base = 16;
810
static const size_t _digits = sizeof(ULONG_PTR) * 2; // 2 digits/byte
911
static const size_t _strSize = _digits + 1;

‎WinArk/ProcessAccessHelper.cpp‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,36 @@ void ProcessAccessHelper::CloseProcessHandle() {
3535
_pSelectedModule = nullptr;
3636
}
3737

38+
DWORD ProcessAccessHelper::GetModuleHandlesFromProcess(const HANDLE hProcess, HMODULE** pphModues) {
39+
DWORD count = 64;
40+
DWORD needed = 0;
41+
*pphModues = new HMODULE[count];
42+
bool notEnough = true;
43+
44+
do
45+
{
46+
if (!EnumProcessModules(hProcess, *pphModues, count * sizeof(HMODULE), &needed)) {
47+
delete[] * pphModues;
48+
return 0;
49+
}
50+
51+
if (count * sizeof(HMODULE) < needed) {
52+
delete[] * pphModues;
53+
count = needed / sizeof(HMODULE);
54+
*pphModues = new HMODULE[count];
55+
}
56+
else {
57+
notEnough = false;
58+
}
59+
} while (notEnough);
60+
61+
count = needed / sizeof(HMODULE);
62+
if (count == 0) {
63+
delete[] * pphModues;
64+
}
65+
return count;
66+
}
67+
3868
#define PAGE_SIZE (4096)
3969

4070
bool ProcessAccessHelper::ReadMemoryFromProcess(DWORD_PTR address, SIZE_T size, LPVOID pData)

‎WinArk/ProcessAccessHelper.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ class ProcessAccessHelper {
7070

7171
static bool OpenProcessHandle(DWORD pid);
7272
static void CloseProcessHandle();
73+
static DWORD GetModuleHandlesFromProcess(const HANDLE hProcess, HMODULE** pphModues);
7374

7475
static bool GetProcessModules(HANDLE hProcess, std::vector<ModuleInfo>& moduleList);
7576

‎WinArk/ScyllaDlg.cpp‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
#include "IATSearcher.h"
66
#include <PEParser.h>
77
#include "ImportRebuilder.h"
8+
#include "DisasmDlg.h"
89

910

1011
CScyllaDlg::CScyllaDlg(const WinSys::ProcessManager& pm, ProcessInfoEx& px)
@@ -613,6 +614,9 @@ void CScyllaDlg::DisplayContextMenuImports(CWindow hwnd, CPoint pt) {
613614
else
614615
_importsHandling.InvalidateImport(over);
615616
break;
617+
case ID_IMPORTS_DISASSEMBLE:
618+
StartDisassembler(over);
619+
break;
616620
case ID_EXPAND_ALL_NODES:
617621
_importsHandling.ExpandAllTreeNodes();
618622
break;
@@ -645,4 +649,29 @@ void CScyllaDlg::SetupImportsMenuItems(CTreeItem item) {
645649
hSub.EnableMenuItem(ID_INVALIDATE, itemOnly);
646650
hSub.EnableMenuItem(ID_CUT_THUNK, importOnly);
647651
hSub.EnableMenuItem(ID_DELETE_TREE_NODE, itemOnly);
652+
}
653+
654+
void CScyllaDlg::StartDisassembler(CTreeItem selectedTreeNode) {
655+
DWORD_PTR address = _importsHandling.GetApiAddressByNode(selectedTreeNode);
656+
if (address) {
657+
BYTE test;
658+
if (!ProcessAccessHelper::ReadMemoryFromProcess(address, sizeof(test), &test)) {
659+
swprintf_s(_text, L"Can't read memory at " PRINTF_DWORD_PTR_FULL, address);
660+
MessageBox(_text, L"Failure", MB_ICONERROR);
661+
}
662+
else {
663+
CDisasmDlg disassembler(address, &_ApiReader);
664+
disassembler.DoModal();
665+
}
666+
}
667+
}
668+
669+
void CScyllaDlg::DisassemblerHandler() {
670+
DWORD_PTR oep = _oepAddress.GetValue();
671+
CDisasmDlg dlg(oep, &_ApiReader);
672+
dlg.DoModal();
673+
}
674+
675+
void CScyllaDlg::OnDisassembler(UINT uNotifyCode, int nID, CWindow wndCtl) {
676+
DisassemblerHandler();
648677
}

‎WinArk/ScyllaDlg.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ class CScyllaDlg
4949
void ShowInvalidImportsHandler();
5050
void ShowSuspectImportsHandler();
5151
void ClearImportsHandler();
52+
void StartDisassembler(CTreeItem selectedTreeNode);
53+
void DisassemblerHandler();
5254

5355
void OnInvalidImports(UINT uNotifyCode, int nID, CWindow wndCtl);
5456
void OnSuspectImports(UINT uNotifyCode, int nID, CWindow wndCtl);
@@ -59,6 +61,7 @@ class CScyllaDlg
5961
void OnDump(UINT uNotifyCode, int nID, CWindow wndCtl);
6062
void OnFixDump(UINT uNotifyCode, int nID, CWindow wndCtl);
6163
void OnPERebuild(UINT uNotifyCode, int nID, CWindow wndCtl);
64+
void OnDisassembler(UINT uNotifyCode, int nID, CWindow wndCtl);
6265

6366
LRESULT OnTreeImportsDoubleClick(const NMHDR* pnmh);
6467
LRESULT OnTreeImportsKeyDown(const NMHDR* pnmh);
@@ -138,6 +141,7 @@ class CScyllaDlg
138141
COMMAND_ID_HANDLER_EX(IDC_BTN_DUMP, OnDump)
139142
COMMAND_ID_HANDLER_EX(IDC_BTN_FIX_DUMP, OnFixDump)
140143
COMMAND_ID_HANDLER_EX(IDC_BTN_PE_REBUILD,OnPERebuild)
144+
COMMAND_ID_HANDLER_EX(ID_MISC_DISASSEMBLER,OnDisassembler)
141145

142146
COMMAND_ID_HANDLER_EX(IDC_BTN_CLEAR,OnClearImports)
143147
COMMAND_ID_HANDLER_EX(IDC_BTN_SHOW_INVALID,OnInvalidImports)

‎WinArk/WinArk.rc‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,20 @@ BEGIN
338338
LISTBOX IDC_LIST_LOG,0,267,413,72,LBS_SORT | LBS_NOINTEGRALHEIGHT | WS_VSCROLL | WS_HSCROLL | WS_TABSTOP
339339
END
340340

341+
IDD_DISASSEMBLER DIALOGEX 0, 0, 463, 244
342+
STYLE DS_SETFONT | DS_FIXEDSYS | WS_POPUP | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME
343+
EXSTYLE WS_EX_TOOLWINDOW
344+
CAPTION "Disassembler"
345+
FONT 8, "MS Shell Dlg", 400, 0, 0x1
346+
BEGIN
347+
CONTROL "",IDC_LIST_DISASSEMBLER,"SysListView32",LVS_REPORT | LVS_ALIGNLEFT | WS_BORDER | WS_TABSTOP,7,7,449,206
348+
LTEXT "Address:",IDC_DISASSEMBLE_ADDRESS,15,222,30,8
349+
EDITTEXT IDC_DISASM_ADDRESS,49,218,107,14,ES_AUTOHSCROLL
350+
PUSHBUTTON "<",IDC_DISASM_BACK,390,218,22,14
351+
PUSHBUTTON ">",IDC_DISASM_FORWARD,418,218,22,14
352+
PUSHBUTTON "Disassemble",IDC_DISASM,166,218,50,14
353+
END
354+
341355

342356
/////////////////////////////////////////////////////////////////////////////
343357
//
@@ -456,6 +470,14 @@ BEGIN
456470
TOPMARGIN, 1
457471
BOTTOMMARGIN, 349
458472
END
473+
474+
IDD_DISASSEMBLER, DIALOG
475+
BEGIN
476+
LEFTMARGIN, 7
477+
RIGHTMARGIN, 456
478+
TOPMARGIN, 7
479+
BOTTOMMARGIN, 237
480+
END
459481
END
460482
#endif // APSTUDIO_INVOKED
461483

@@ -565,6 +587,11 @@ BEGIN
565587
0
566588
END
567589

590+
IDD_DISASSEMBLER AFX_DIALOG_LAYOUT
591+
BEGIN
592+
0
593+
END
594+
568595

569596
/////////////////////////////////////////////////////////////////////////////
570597
//
@@ -878,7 +905,10 @@ BEGIN
878905
MENUITEM "&Dump", ID_FILE_DUMP
879906
END
880907
MENUITEM "Imports", ID_IMPORTS
881-
MENUITEM "Misc", ID_MISC
908+
POPUP "Misc"
909+
BEGIN
910+
MENUITEM "Disassembler", ID_MISC_DISASSEMBLER
911+
END
882912
MENUITEM "Help", ID_HELP33025
883913
END
884914

@@ -917,6 +947,21 @@ BEGIN
917947
MENUITEM SEPARATOR
918948
MENUITEM "Expand all nodes", ID_EXPAND_ALL_NODES
919949
MENUITEM "Collapse all nodes", ID_COLLAPSE_ALL_NODES
950+
MENUITEM SEPARATOR
951+
MENUITEM "Disassemble", ID_IMPORTS_DISASSEMBLE
952+
END
953+
END
954+
955+
IDR_DISASM MENU
956+
BEGIN
957+
POPUP "Disasm"
958+
BEGIN
959+
MENUITEM "Follow", ID_DISASM_FOLLOW
960+
MENUITEM "Disassemble here", ID_DISASM_DISASSEMBLE_HERE
961+
MENUITEM "Copy Address", ID_DISASM_COPY_ADDRESS
962+
MENUITEM "Copy Size", ID_DISASM_COPY_SIZE
963+
MENUITEM "Copy OpCodes", ID_DISASM_COPY_OPCODES
964+
MENUITEM "Copy Instructions", ID_DISASM_COPY_INSTRUCTIONS
920965
END
921966
END
922967

‎WinArk/WinArk.vcxproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,7 @@
255255
<ClCompile Include="BinaryValueDlg.cpp" />
256256
<ClCompile Include="BypassDlg.cpp" />
257257
<ClCompile Include="CallStackDlg.cpp" />
258+
<ClCompile Include="DisasmDlg.cpp" />
258259
<ClCompile Include="ExplorerView.cpp" />
259260
<ClCompile Include="ExtensionTable.cpp" />
260261
<ClCompile Include="ExtensionTableDlg.cpp" />
@@ -429,6 +430,7 @@
429430
<ClInclude Include="ComHelper.h" />
430431
<ClInclude Include="CustomListView.h" />
431432
<ClInclude Include="CustomSplitterWindow.h" />
433+
<ClInclude Include="DisasmDlg.h" />
432434
<ClInclude Include="ExplorerView.h" />
433435
<ClInclude Include="ExtensionTable.h" />
434436
<ClInclude Include="ExtensionTableDlg.h" />

‎WinArk/WinArk.vcxproj.filters‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -534,6 +534,9 @@
534534
<ClCompile Include="ImportRebuilder.cpp">
535535
<Filter>Scylla</Filter>
536536
</ClCompile>
537+
<ClCompile Include="DisasmDlg.cpp">
538+
<Filter>Scylla</Filter>
539+
</ClCompile>
537540
</ItemGroup>
538541
<ItemGroup>
539542
<ClInclude Include="stdafx.h">
@@ -1076,6 +1079,9 @@
10761079
<ClInclude Include="ImportRebuilder.h">
10771080
<Filter>Scylla</Filter>
10781081
</ClInclude>
1082+
<ClInclude Include="DisasmDlg.h">
1083+
<Filter>Scylla</Filter>
1084+
</ClInclude>
10791085
</ItemGroup>
10801086
<ItemGroup>
10811087
<ResourceCompile Include="WinArk.rc">

0 commit comments

Comments
 (0)