Remove accessType from BackPatch's signature in favor of getting it from DisassembleMov.

It isn't easily accessible with sigaction or Mach exceptions (well,
requires an additional system call in the latter), and isn't necessary.

(and get rid of the enum, because it's only used once, and the comments
are more expressive than enum names)
This commit is contained in:
comex
2013-09-02 16:37:04 -04:00
parent e198e201e4
commit 4c3230bcde
9 changed files with 109 additions and 129 deletions

View File

@ -33,21 +33,12 @@ struct ModRM
}
};
enum{
MOVZX_BYTE = 0xB6, //movzx on byte
MOVZX_SHORT = 0xB7, //movzx on short
MOVSX_BYTE = 0xBE, //movsx on byte
MOVSX_SHORT = 0xBF, //movsx on short
MOVE_8BIT = 0xC6, //move 8-bit immediate
MOVE_16_32BIT = 0xC7, //move 16 or 32-bit immediate
MOVE_REG_TO_MEM = 0x89, //move reg to memory
};
enum AccessType{
enum AccessType
{
OP_ACCESS_READ = 0,
OP_ACCESS_WRITE = 1
};
bool DisassembleMov(const unsigned char *codePtr, InstructionInfo &info, int accessType);
bool DisassembleMov(const unsigned char *codePtr, InstructionInfo *info);
#endif // _X64ANALYZER_H_