Question

我正在用 C++ 编写修补程序，作为项目的一部分，我正在使用 Zydis 编写反汇编程序，我将内存操作码发送到函数，该函数基本上将每个字节转换为 dec 并将其推入数组，该函数将返回指向数组及其大小的指针结构。关键是在调用者函数中 - 在调用函数之后，我试图以返回大小的大小分配内存。

ZyanU8* data = new ZyanU8[temp.size];

在运行时，我收到“project.exe 触发了断点”的错误，实际上它发生在每个大分配的大小中，它也与它的类型是 ZyanU8 的事实无关，我试过它与 int 和我得到相同的我该如何解决？

struct memArray
{
    int* arr;
    int size;
};

memArray convert_to_ZyanU8(DWORD* Total, DWORD size)
{
    int size_ = 0;
    int* dwTA=new int[(size/0x400)*0x100];
    for (int j = 0; j < size / 0x400; j++)//understand size
    {
        for (int i = 0; i < 0x100; i++)
        {
            char buffer[9];
            sprintf_s(buffer, "%x", Total[j*0x100+i]);
            int counter = 0;
            for (int n = 0; n < 8; n+=2)
            {
                unsigned int xfirst;
                std::stringstream sfirst;
                sfirst << std::hex << *(buffer+n);
                sfirst >> xfirst;
                unsigned int xsecond;
                std::stringstream ssecond;
                ssecond << std::hex << *(buffer+n+1);
                ssecond >> xsecond;
                dwTA[j*0x100+i*4 + counter] = xfirst*16+xsecond;
                ++counter;
                ++size_;
                if (size_ == 12287)
                    int a = 3;
            }
        }
    }
    memArray memarray;
    memarray.arr = dwTA;
    memarray.size = size_;
    return memarray;
}


void ZydisDA(DWORD* Total,DWORD size)
{
    memArray temp = convert_to_ZyanU8(Total, size);
    ZyanU8* data = new ZyanU8[temp.size];
    int counter = 0;
    for (int i = 0; i < temp.size; ++i)
    {
        data[i] = temp.arr[i];
    }
    // Initialize decoder context
    ZydisDecoder decoder;
    ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32,ZYDIS_ADDRESS_WIDTH_32);

    // Initialize formatter. Only required when you actually plan to do instruction
    // formatting ("disassembling"), like we do here
    ZydisFormatter formatter;
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);

    // Loop over the instructions in our buffer.
    // The runtime-address (instruction pointer) is chosen arbitrary here in order to better
    // visualize relative addressing
    ZyanU64 runtime_address = 0x00401000;
    ZyanUSize offset = 0;
    const ZyanUSize length = temp.size;
    ZydisDecodedInstruction instruction;
    while ((ZydisDecoderDecodeBuffer(&decoder, data + offset, length - offset, &instruction)))
    {
        // Print current instruction pointer.
        printf("%016" PRIX64 "  ", runtime_address);

        // Format & print the binary instruction structure to human readable format
        char buffer[256];
        ZydisFormatterFormatInstruction(&formatter, &instruction, buffer, sizeof(buffer),        runtime_address);
        puts(buffer);

        offset += instruction.length;
        runtime_address += instruction.length;
    }
}

project.exe 已触发动态分配导致的断点

0 个答案: