x64 architecture support for decompilation through a helper symbol

ConspiracyHu · Apr 16, 2024 · ee3eff1 · ee3eff1
1 parent 701a686
commit ee3eff1
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 6 deletions.
diff --git a/ExeToKKPUncompressed/ExeToKKPUncompressed.cpp b/ExeToKKPUncompressed/ExeToKKPUncompressed.cpp
@@ -93,8 +93,8 @@ BOOL CALLBACK EnumSymbols(SYMBOL_INFO* info, ULONG size, void* param)
   sym.name = info->Name;
   sym.fileID = 0;
   sym.VA = info->Address;
-  sym.size = info->Size;
-  sym.isCode = false;
+  sym.size = size ? size : info->Size;
+  sym.isCode = info->Tag == SymTagFunction;
 
 /*
   if ( sym.size == 0 )
@@ -151,8 +151,6 @@ BOOL CALLBACK EnumSymbols(SYMBOL_INFO* info, ULONG size, void* param)
 
   sym.fileID = -1;
 
-  IMAGEHLP_LINE64 LineInfo;
-  LineInfo.SizeOfStruct = sizeof( IMAGEHLP_LINE64 );
   symbols.emplace_back( sym );
 
   return TRUE;

diff --git a/kkp.cpp b/kkp.cpp
@@ -266,8 +266,11 @@ void BuildSymbolList( std::vector<KKP::KKPSymbol>& target, const KKP::KKPSymbol&
   }
 }
 
+bool KKP::isX64 = false;
+
 void KKP::Load( const std::string& fileName )
 {
+  isX64 = false;
   root = KKPSymbol();
   files.clear();
   bytes.clear();
@@ -337,7 +340,10 @@ void KKP::Load( const std::string& fileName )
 
       s.originalSymbolID = x;
 
-      AddSymbol( s );
+      if ( s.name == "Code::<arch: x64>" )
+        isX64 = true;
+      else
+        AddSymbol( s );
     }
   }
 

diff --git a/kkp.h b/kkp.h
@@ -6,6 +6,8 @@ class KKP
 {
 public:
 
+  static bool isX64;
+
 #pragma pack(push)
 #pragma pack(1)
   struct KKPFile

diff --git a/main.cpp b/main.cpp
@@ -350,7 +350,7 @@ void SelectByte( KKP::KKPByteData& byte )
 
       ZyanUSize offset = 0;
       ZydisDisassembledInstruction instruction;
-      while ( ZYAN_SUCCESS( ZydisDisassembleIntel( ZYDIS_MACHINE_MODE_LONG_COMPAT_32, address, data + offset, symbol.unpackedSize - offset, &instruction ) ) )
+      while ( ZYAN_SUCCESS( ZydisDisassembleIntel( KKP::isX64 ? ZYDIS_MACHINE_MODE_LONG_64 : ZYDIS_MACHINE_MODE_LONG_COMPAT_32, address, data + offset, symbol.unpackedSize - offset, &instruction ) ) )
       {
         DisassemblyLine line;
         line.address = (int)address;