PDA

View Full Version : Reading the analysis data in a plugin

Victoria
October 6th, 2006, 07:14
Hi,

I'm trying to read the rows of the CPU disasm after the analysis. I've tried first getting the t_dump structure with Plugingetvalue(CPU_DASM) - this works OK, just as getting the t_table table field. Unfortunately when I try to get the t_sorted data field from the table, I receive only an empty sorted data (n field is 0). So how do you read the rows of this table?

The purpose of this is that I need to check if some addresses of a disassembled process contain data or code, which I can't do just by using the Disasm function, which pretty much always disassembles any given address. For that I need to read the full analysis. Is there any other, simpler way of achieving this?

Thanks
blabberer
October 6th, 2006, 14:36
you mean you trying to do something like this and it always results in 0
yes thats what i have observed too while i was trying some thing
but i discarded looking at this t_dump crap so cant tell you much

Code:


	case 2:

		{

			

			t_dump td;

			HWND myhw;

			int tdadd;

			int actnoent;

			char foo[MAX_PATH];

			

			

			

			td = *(t_dump *)Plugingetvalue(VAL_CPUDASM);

			tdadd = (int)Plugingetvalue(VAL_CPUDASM);

			

			myhw = td.table.hw;

			strncpy(foo,td.table.data.name,MAX_PATH);

			actnoent = td.table.data.n;



			Addtolist((long)tdadd,1,"CPU_DASM address is %x",tdadd);

			Addtolist((long)myhw,1,"CPU_DASM address is %x",myhw);

			Addtolist((long)foo,1,"CPU_DASM address is %s",foo);

			Addtolist((long)actnoent,1,"CPU_DASM address is %x",actnoent);

			

			

			

			

			break;

		}



Log data

Address    Message

004CD6A8   CPU_DASM address is 4cd6a8

0055026C   CPU_DASM address is 55026c

0012DCC4   CPU_DASM address is CPU disasm

           CPU_DASM address is 0 <---------


anyway doesnt Findmodule suit your needs ?

t_module* Findmodule(ulong addr);

but beware that structure too has many undocumented fields
especially i was interested in looking up some debuginfo fields
and found i cant find answers to few fields
Victoria
October 8th, 2006, 06:34
Quote:
anyway doesnt Findmodule suit your needs ?

Not really, but Finddecode does Thanks for your reply.