node/lib/metasm/samples/dasm-plugins/scanfuncstart.rb
def scanfuncstart(addr)
	if o = (1..16).find { |off| @decoded[addr-off].kind_of? DecodedInstruction } and @decoded[addr-o].bin_length == o
		addr -= o
	end
	if @decoded[addr].kind_of? DecodedInstruction
		fs = find_function_start(addr)
		return fs if fs != addr
	end
	edata = get_edata_at(addr)
	if o = (1..1000).find { |off|
		@decoded[addr-off-1] or
		edata.data[edata.ptr-off-1] == ?\xcc or
		edata.data[edata.ptr-off-1] == ?\xc3 or
		edata.data[edata.ptr-off-3] == ?\xc2
	}
		o -= @decoded[addr-o-1].bin_length-1 if @decoded[addr-o-1].kind_of? DecodedInstruction
		addr-o
	end
end
# metasm dasm plugin: scan the memory for a 'ret' which could indicate the beginning of the current function
# (x86 only)
metasm dasm plugin: scan the memory for a 'ret' which could indicate the beginning of the current function
(x86 only)
metasm dasm plugin : scan the memory for a ' ret ' which could indicate the beginning of the current function ( x86 only )
def scanfuncstart(addr)
	if o = (1..16).find { |off| @decoded[addr-off].kind_of? DecodedInstruction } and @decoded[addr-o].bin_length == o
		addr -= o
	end
	if @decoded[addr].kind_of? DecodedInstruction
		fs = find_function_start(addr)
		return fs if fs != addr
	end
	edata = get_edata_at(addr)
	if o = (1..1000).find { |off|
		@decoded[addr-off-1] or
		edata.data[edata.ptr-off-1] == ?\xcc or
		edata.data[edata.ptr-off-1] == ?\xc3 or
		edata.data[edata.ptr-off-3] == ?\xc2
	}
		o -= @decoded[addr-o-1].bin_length-1 if @decoded[addr-o-1].kind_of? DecodedInstruction
		addr-o
	end
end
def scanfuncstart ( addr ) if o = ( 1 .. 16 ) . find { | off | @decoded [ addr - off ] . kind_of? DecodedInstruction } and @decoded [ addr - o ] . bin_length == o addr -= o end if @decoded [ addr ] . kind_of? DecodedInstruction fs = find_function_start ( addr ) return fs if fs != addr end edata = get_edata_at ( addr ) if o = ( 1 .. 1000 ) . find { | off | @decoded [ addr - off - 1 ] or edata . data [ edata . ptr - off - 1 ] == ?\xcc or edata . data [ edata . ptr - off - 1 ] == ?\xc3 or edata . data [ edata . ptr - off - 3 ] == ?\xc2 } o -= @decoded [ addr - o - 1 ] . bin_length - 1 if @decoded [ addr - o - 1 ] . kind_of? DecodedInstruction addr - o end end
metasm dasm plugin: scan the memory for a 'ret' which could indicate the beginning of the current function
(x86 only)
metasm dasm plugin : scan the memory for a ' ret ' which could indicate the beginning of the current function ( x86 only )
addr