ulong Ndisasm(uchar *cmd,ulong size,ulong ip,t_netasm *da,int mode,t_module *pmod);
Disassembles binary Common Intermediate Language (.NET) command, at most size bytes long, to text. Note that .NET support in OllyDbg is still rudimentary
Parameters:
cmd
(in) Pointer to the binary code of the CIL command, size bytes long
size
(in) Size of the data pointed to by cmd
ip
(in) Address of the CIL command in memory
da
(out) Pointer to the structure of type t_netasm, buffer that receives disassembly results
mode
(in) Disassembling mode, a combination of zero or more of the bit flags listed below:
DA_TEXT - decode command to text
DA_OPCOMM - comment command and report errors in text form
DA_DUMP - create hexadecimal dump
pmod
DA_TEXT - decode command to text
DA_OPCOMM - comment command and report errors in text form
DA_DUMP - create hexadecimal dump
(in) Pointer to the structure of type t_module, descriptor of the module containing CIL code. The functionality of Ndisasm() is not guaranteed if this pointer is NULL
Return values:
On
success, returns length of the command in bytes. If command is not
matched or does not fit into the size of the supplied code, reports
error in da->comment and return 1. On severe error, returns 0.
See also: