Skip to content

Instantly share code, notes, and snippets.

@trylek
Created April 13, 2020 16:54
Show Gist options
  • Save trylek/792b8e78e5330bf5aada8b5eaad94933 to your computer and use it in GitHub Desktop.
Save trylek/792b8e78e5330bf5aada8b5eaad94933 to your computer and use it in GitHub Desktop.
ReadFile PInvoke native code produced by Crossgen1
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr)
Handle: 0x0600004B
Rid: 75
Number of RuntimeFunctions: 2
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr)
Size: 233 bytes
Version: 1
Flags: 0x03 EHANDLER UHANDLER
SizeOfProlog: 0x0013
CountOfUnwindCodes: 10
FrameRegister: RAX
FrameOffset: 0x0
UnwindCode[0]: CodeOffset 0x0013 FrameOffset 0x0113 NextOffset 0x200 Op 0 -
UnwindCode[1]: CodeOffset 0x0019 FrameOffset 0x0019 NextOffset 0x-1 Op Scaled small
UnwindCode[2]: CodeOffset 0x000C FrameOffset 0x300C NextOffset 0x-1 Op RBX(3)
UnwindCode[3]: CodeOffset 0x000B FrameOffset 0x600B NextOffset 0x-1 Op RSI(6)
UnwindCode[4]: CodeOffset 0x000A FrameOffset 0x700A NextOffset 0x-1 Op RDI(7)
UnwindCode[5]: CodeOffset 0x0009 FrameOffset 0xC009 NextOffset 0x-1 Op R12(12)
UnwindCode[6]: CodeOffset 0x0007 FrameOffset 0xD007 NextOffset 0x-1 Op R13(13)
UnwindCode[7]: CodeOffset 0x0005 FrameOffset 0xE005 NextOffset 0x-1 Op R14(14)
UnwindCode[8]: CodeOffset 0x0003 FrameOffset 0xF003 NextOffset 0x-1 Op R15(15)
UnwindCode[9]: CodeOffset 0x0001 FrameOffset 0x5001 NextOffset 0x-1 Op RBP(5)
EH info @ 818BF0, #clauses = 1
Flags 04 TryOff 0042 (RVA 3BE472) TryEnd 00C6 (RVA 3BE4F6) HndOff 00E9 (RVA 3BE519) HndEnd 012B (RVA 3BE55B) ClsFlt 0000 FAULT
push rbp
UWOP_PUSH_NONVOL RBP(5)
push r15
UWOP_PUSH_NONVOL R15(15)
push r14
UWOP_PUSH_NONVOL R14(14)
push r13
UWOP_PUSH_NONVOL R13(13)
push r12
UWOP_PUSH_NONVOL R12(12)
push rdi
UWOP_PUSH_NONVOL RDI(7)
push rsi
UWOP_PUSH_NONVOL RSI(6)
push rbx
UWOP_PUSH_NONVOL RBX(3)
sub rsp, 200
lea rbp, [rsp + 256]
mov qword ptr [rbp - 112], r10
xor eax, eax
mov qword ptr [rbp - 72], rax
mov qword ptr [rbp - 80], rax
mov qword ptr [rbp - 216], rsp
mov qword ptr [rbp + 16], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword ptr [rbp - 64], edx
lea rdx, [rbp - 64]
mov rcx, qword ptr [rbp + 16]
RCX is live
call qword ptr [IntPtr System.StubHelpers.StubHelpers.SafeHandleAddRef(System.Runtime.InteropServices.SafeHandle, ref Boolean) (METHOD_ENTRY)]
RCX is dead
mov r14, rax
movsxd rbx, ebx
mov qword ptr [rbp - 72], rsi
call qword ptr [Void System.StubHelpers.StubHelpers.ClearLastError() (METHOD_ENTRY)]
mov rcx, qword ptr [rbp - 112]
mov rcx, qword ptr [rcx + 32]
mov r15, qword ptr [rcx]
mov r12, qword ptr [rbp + 48]
mov qword ptr [rsp + 32], r12
mov rcx, r14
mov qword ptr [rbp - 88], rcx
mov rdx, rdi
mov qword ptr [rbp - 96], rdx
mov r8, rbx
mov qword ptr [rbp - 104], r8
mov r9, rsi
R9 is live
mov qword ptr [rbp - 80], r9
lea rcx, [rbp - 200]
RSI is dead
R9 is dead
call qword ptr [PINVOKE_BEGIN (HELPER)]
mov rcx, qword ptr [rbp - 88]
mov rdx, qword ptr [rbp - 96]
mov r8, qword ptr [rbp - 104]
mov r9, qword ptr [rbp - 80]
call r15
mov esi, eax
lea rcx, [rbp - 200]
call qword ptr [PINVOKE_END (HELPER)]
call qword ptr [Void System.StubHelpers.StubHelpers.SetLastError() (METHOD_ENTRY)]
nop
cmp byte ptr [rbp - 64], 0
je 0x00D6
mov rcx, qword ptr [rbp + 16]
RCX is live
sp+16 is dead
call qword ptr [Void System.StubHelpers.StubHelpers.SafeHandleRelease(System.Runtime.InteropServices.SafeHandle) (METHOD_ENTRY)]
RCX is dead
mov eax, esi
sp+16 is live
lea rsp, [rbp - 56]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr)
Size: 66 bytes
Version: 1
Flags: 0x03 EHANDLER UHANDLER
SizeOfProlog: 0x0010
CountOfUnwindCodes: 9
FrameRegister: RAX
FrameOffset: 0x0
UnwindCode[0]: CodeOffset 0x0010 FrameOffset 0x6210 NextOffset 0x-1 Op 56
UnwindCode[1]: CodeOffset 0x000C FrameOffset 0x300C NextOffset 0x-1 Op RBX(3)
UnwindCode[2]: CodeOffset 0x000B FrameOffset 0x600B NextOffset 0x-1 Op RSI(6)
UnwindCode[3]: CodeOffset 0x000A FrameOffset 0x700A NextOffset 0x-1 Op RDI(7)
UnwindCode[4]: CodeOffset 0x0009 FrameOffset 0xC009 NextOffset 0x-1 Op R12(12)
UnwindCode[5]: CodeOffset 0x0007 FrameOffset 0xD007 NextOffset 0x-1 Op R13(13)
UnwindCode[6]: CodeOffset 0x0005 FrameOffset 0xE005 NextOffset 0x-1 Op R14(14)
UnwindCode[7]: CodeOffset 0x0003 FrameOffset 0xF003 NextOffset 0x-1 Op R15(15)
UnwindCode[8]: CodeOffset 0x0001 FrameOffset 0x5001 NextOffset 0x-1 Op RBP(5)
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 56
mov rbp, qword ptr [rcx + 40]
mov qword ptr [rsp + 40], rbp
lea rbp, [rbp + 256]
cmp byte ptr [rbp - 64], 0
je 0x0030
mov rcx, qword ptr [rbp + 16]
RCX is live
sp+16 is dead
call qword ptr [Void System.StubHelpers.StubHelpers.SafeHandleRelease(System.Runtime.InteropServices.SafeHandle) (METHOD_ENTRY)]
RCX is dead
nop
add rsp, 56
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment