C# IRewriterHost.GetInterceptedCall方法代码示例

 public override ProcedureBase GetTrampolineDestination(ImageReader rdr, IRewriterHost host)
 {
     var rw = Architecture.CreateRewriter(
         rdr,
         Architecture.CreateProcessorState(),
         Architecture.CreateFrame(), host);
     var rtlc = rw.FirstOrDefault();
     if (rtlc == null || rtlc.Instructions.Count == 0)
         return null;
     var jump = rtlc.Instructions[0] as RtlGoto;
     if (jump == null)
         return null;
     var pc = jump.Target as ProcedureConstant;
     if (pc != null)
         return pc.Procedure;
     var access = jump.Target as MemoryAccess;
     if (access == null)
         return null;
     var addrTarget = access.EffectiveAddress as Address;
     if (addrTarget == null)
     {
         var wAddr = access.EffectiveAddress as Constant;
         if (wAddr == null)
         {
             return null;
         }
         addrTarget = MakeAddressFromConstant(wAddr);
     }
     ProcedureBase proc = host.GetImportedProcedure(addrTarget, rtlc.Address);
     if (proc != null)
         return proc;
     return host.GetInterceptedCall(addrTarget);
 }

        //public override ProcedureBase GetTrampolineDestination(ImageReader rdr, IRewriterHost host)
        //{
        //    var dasm = new PowerPcDisassembler(this, rdr, WordWidth);
        //    return GetTrampolineDestination(dasm, host);
        //}

        /// <summary>
        /// Detects the presence of a PowerPC trampoline and returns the imported function 
        /// that is actually being requested.
        /// </summary>
        /// <remarks>
        /// A PowerPC trampoline looks like this:
        ///     addis  rX,r0,XXXX (or oris rx,r0,XXXX)
        ///     lwz    rY,YYYY(rX)
        ///     mtctr  rY
        ///     bctr   rY
        /// When loading the ELF binary, we discovered the memory locations
        /// that will contain pointers to imported functions. If the address
        /// XXXXYYYY matches one of those memory locations, we have found a
        /// trampoline.
        /// </remarks>
        /// <param name="rdr"></param>
        /// <param name="host"></param>
        /// <returns></returns>
        public ProcedureBase GetTrampolineDestination(IEnumerable<PowerPcInstruction> rdr, IRewriterHost host)
        {
            var e = rdr.GetEnumerator();

            if (!e.MoveNext() || (e.Current.Opcode != Opcode.addis && e.Current.Opcode != Opcode.oris))
                return null;
            var addrInstr = e.Current.Address;
            var reg = ((RegisterOperand)e.Current.op1).Register;
            var uAddr = ((ImmediateOperand)e.Current.op3).Value.ToUInt32() << 16;

            if (!e.MoveNext() || e.Current.Opcode != Opcode.lwz)
                return null;
            var mem = e.Current.op2 as MemoryOperand;
            if (mem == null)
                return null;
            if (mem.BaseRegister != reg)
                return null;
            uAddr = (uint)((int)uAddr + mem.Offset.ToInt32());
            reg = ((RegisterOperand)e.Current.op1).Register;

            if (!e.MoveNext() || e.Current.Opcode != Opcode.mtctr)
                return null;
            if (((RegisterOperand)e.Current.op1).Register != reg)
                return null;

            if (!e.MoveNext() || e.Current.Opcode != Opcode.bcctr)
                return null;

            // We saw a thunk! now try to resolve it.

            var addr = Address.Ptr32(uAddr);
            var ep = host.GetImportedProcedure(addr, addrInstr);
            if (ep != null)
                return ep;
            return host.GetInterceptedCall(addr);
        }

        /// <summary>
        /// The sequence 
        ///     lui rX,hiword
        ///     lw  rY,[rX + loword]
        ///     jr  rY
        /// is treated as a trampoline.
        /// </summary>
        /// <param name="imageReader"></param>
        /// <param name="host"></param>
        /// <returns></returns>
        public override ProcedureBase GetTrampolineDestination(ImageReader imageReader, IRewriterHost host)
        {
            var rtls = Architecture.CreateRewriter(
                imageReader,
                Architecture.CreateProcessorState(),
                Architecture.CreateFrame(),
                host)
                .Take(3)
                .ToArray();
            if (rtls.Length < 3)
                return null;
            var instrs = rtls
                .SelectMany(rtl => rtl.Instructions)
                .ToArray();

            for (int i = 0; i < 3; ++i)
            {
                if (!trampPattern[i].Match(instrs[i]))
                    return null;
            }
            if (trampPattern[0].CapturedExpressions("r0d") != trampPattern[1].CapturedExpressions("r1s"))
                return null;
            if (trampPattern[1].CapturedExpressions("r1d") != trampPattern[2].CapturedExpressions("r2s"))
                return null;
            var hi = (Constant)trampPattern[0].CapturedExpressions("hi");
            var lo = (Constant)trampPattern[1].CapturedExpressions("lo");
            var c = Operator.IAdd.ApplyConstants(hi, lo);
            var addrTarget= MakeAddressFromConstant(c);
            ProcedureBase proc = host.GetImportedProcedure(addrTarget, rtls[2].Address);
            if (proc != null)
                return proc;
            return host.GetInterceptedCall(addrTarget);
        }