Zydis反汇编引擎v4版本测试代码
这版本直接以.h .c文件提供,可以直接加入工程,方便了不少
ZydisDisassembledInstruction insn;
ZydisDisassembleIntel(ZYDIS_MACHINE_MODE_LONG_COMPAT_32, (ZyanU64)ip, ip,
15, &insn);
ZyanU64 ResultAddress;
if (insn.info.mnemonic == ZYDIS_MNEMONIC_CALL) {
ZydisCalcAbsoluteAddress(&insn.info, insn.operands, (ZyanU64)ip,
&ResultAddress);
TraceFile << hex << "ip : ResultAddress " << ip << "\t" << ResultAddress
<< endl;
if (ResultAddress > NtdllModule->start_ && ResultAddress < NtdllModule->end_) {
auto it = kSymbolInfo[NtdllModuleIndex].begin();
it = kSymbolInfo[NtdllModuleIndex].find(ResultAddress);
if (it != kSymbolInfo[NtdllModuleIndex].end()) {
TraceFile << "Call -> " << it->second << endl;
}
}