Decode reads the thread context structure from the given process memory and at the specified base address. Returns the decoded Context struct or nil if the data cannot be read from the remote process address space.
(pid uint32, addr va.Address)
| 72 | // or nil if the data cannot be read from the remote |
| 73 | // process address space. |
| 74 | func Decode(pid uint32, addr va.Address) *Context { |
| 75 | proc, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION|windows.PROCESS_VM_READ, false, pid) |
| 76 | if err != nil { |
| 77 | return nil |
| 78 | } |
| 79 | defer windows.Close(proc) |
| 80 | |
| 81 | size := uint(unsafe.Sizeof(Context{})) |
| 82 | ctx := va.ReadArea(proc, addr.Uintptr(), size, size, false) |
| 83 | if !va.Zeroed(ctx) { |
| 84 | return (*Context)(unsafe.Pointer(&ctx[0])) |
| 85 | } |
| 86 | |
| 87 | return nil |
| 88 | } |
| 89 | |
| 90 | // Rip returns the address stored in the instruction pointer register. |
| 91 | func Rip(pid uint32, addr va.Address) va.Address { |