Disassembleback

ulong Disassembleback(uchar *copy,ulong base,ulong size,ulong ip,ulong n,uchar *decode);

Calculates address of the n-th command preceding address ip in the code block described by base and size. If copy of executable code is not supplied, function assumes memory and reads it by itself. In this case correct functionality is guaranteed only for n<=256. Backstepping of 80x86 code is a nontrivial task. If decoding data is unavailable, this function is relatively slow and not error-prone (although errors are usually not critical).


Parameters:

copy
(in) Pointer to the copy of the executable code that starts at address base and is at least size bytes long. If copy is NULL, function assumes that code is in the memory of the debugged process and reads it automatically. Due to the limited size of the internal buffer, correct answer in this case is guaranteed only if n does not exceed 256
base
(in) Base address of the memory block pointed to by copy
size
(in) Size, in bytes, of the memory block pointed to by copy
ip
(in) Address of the initial command
n
(in) Number of commands to backstep. For example, n=1 means command that immediately precedes initial command
decode
(in) Pointer to the decoding data, USEDECODE if function must get decoding data automatically, or NULL if decoding is not necessary or unavailable. If decoding data is supplied, it must start at base and be at least size bytes long. Use decoding if you want to treat embedded data recognized by Analyser the same way as commands


Return values:

On success, returns starting address of the n-th command preceding ip or base, whichever is larger. On error, returns ip


See also:
Analysis, Assembler and disassembler, Disassembleforward(), Dumpback(), Dumpforward()