Disassembleback
ulong
Disassembleback(uchar *copy,ulong base,ulong size,ulong ip,ulong
n,uchar *decode);
Calculates address of the n-th
command preceding address ip
in the code block described by base
and size.
If copy of
executable code is not supplied, function assumes memory and reads it
by itself. In this case correct functionality is guaranteed only for n<=256.
Backstepping of 80x86 code is a nontrivial task. If decoding data
is unavailable, this function is relatively slow and not
error-prone (although errors are usually not critical).
Parameters:
copy
(in)
Pointer to the copy of the executable code that starts at address base and is at least
size bytes
long. If copy
is NULL, function assumes that code is in the memory of the debugged
process and reads it automatically. Due to the limited size of the
internal buffer, correct answer in this case is guaranteed only if n does not exceed 256
base
(in) Base
address of the memory block pointed to by copy
size
(in) Size,
in bytes, of the memory
block pointed to by copy
ip
(in)
Address of the initial command
n
(in) Number
of commands to backstep. For example, n=1 means command that immediately precedes initial command
decode
(in)
Pointer to the decoding data, USEDECODE if
function must get decoding data automatically, or NULL if decoding is
not necessary or unavailable. If decoding data is supplied, it
must start at base
and be at least size
bytes long. Use decoding if you want to treat embedded data recognized
by Analyser the same way as commands
Return
values:
On
success, returns starting address of the n-th command preceding ip or base, whichever is larger. On error, returns ip
See
also: