Zydis反汇编引擎v4版本测试代码

这版本直接以.h .c文件提供,可以直接加入工程,方便了不少

ZydisDisassembledInstruction insn;
    ZydisDisassembleIntel(ZYDIS_MACHINE_MODE_LONG_COMPAT_32, (ZyanU64)ip, ip,
                          15, &insn);
    ZyanU64 ResultAddress;
    if (insn.info.mnemonic == ZYDIS_MNEMONIC_CALL) {
      ZydisCalcAbsoluteAddress(&insn.info, insn.operands, (ZyanU64)ip,
                               &ResultAddress);

      TraceFile << hex << "ip : ResultAddress " << ip << "\t" << ResultAddress
                                                                     << endl;

      if (ResultAddress > NtdllModule->start_ && ResultAddress < NtdllModule->end_) {
        auto it = kSymbolInfo[NtdllModuleIndex].begin();
        it = kSymbolInfo[NtdllModuleIndex].find(ResultAddress);
        if (it != kSymbolInfo[NtdllModuleIndex].end()) {
          TraceFile << "Call -> " << it->second << endl;
        }
      }
1