Skip to content

Instantly share code, notes, and snippets.

@trylek
Created April 13, 2020 16:54
Show Gist options
  • Save trylek/d40cfd3efb26326aadf3e9eb5df4d788 to your computer and use it in GitHub Desktop.
Save trylek/d40cfd3efb26326aadf3e9eb5df4d788 to your computer and use it in GitHub Desktop.
ReadFile PInvoke native code compiled with Crossgen2
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr)
Handle: 0x0600004C
Rid: 76
Number of RuntimeFunctions: 2
Number of fixups: 5
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr) (INDIRECT_PINVOKE_TARGET)
bool (TYPE_HANDLE)
int (TYPE_HANDLE)
IntPtr (TYPE_HANDLE)
void (TYPE_HANDLE)
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr)
Size: 223 bytes
Version: 1
Flags: 0x03 EHANDLER UHANDLER
SizeOfProlog: 0x0013
CountOfUnwindCodes: 10
FrameRegister: RAX
FrameOffset: 0x0
UnwindCode[0]: CodeOffset 0x0013 FrameOffset 0x0113 NextOffset 0x184 Op 0 -
UnwindCode[1]: CodeOffset 0x0017 FrameOffset 0x0017 NextOffset 0x-1 Op Scaled small
UnwindCode[2]: CodeOffset 0x000C FrameOffset 0x300C NextOffset 0x-1 Op RBX(3)
UnwindCode[3]: CodeOffset 0x000B FrameOffset 0x600B NextOffset 0x-1 Op RSI(6)
UnwindCode[4]: CodeOffset 0x000A FrameOffset 0x700A NextOffset 0x-1 Op RDI(7)
UnwindCode[5]: CodeOffset 0x0009 FrameOffset 0xC009 NextOffset 0x-1 Op R12(12)
UnwindCode[6]: CodeOffset 0x0007 FrameOffset 0xD007 NextOffset 0x-1 Op R13(13)
UnwindCode[7]: CodeOffset 0x0005 FrameOffset 0xE005 NextOffset 0x-1 Op R14(14)
UnwindCode[8]: CodeOffset 0x0003 FrameOffset 0xF003 NextOffset 0x-1 Op R15(15)
UnwindCode[9]: CodeOffset 0x0001 FrameOffset 0x5001 NextOffset 0x-1 Op RBP(5)
EH info @ 2BD6B, #clauses = 1
Flags 04 TryOff 0039 (RVA 2B999) TryEnd 00BA (RVA 2BA1A) HndOff 00DF (RVA 2BA3F) HndEnd 0123 (RVA 2BA83) ClsFlt 0000 FAULT
Debug Info
Bounds:
IL Offset: 0xFFFFFFFE, Source Types: StackEmpty
IL Offset: 0x0, Source Types: StackEmpty
IL Offset: 0xF, Source Types: StackEmpty
IL Offset: 0x17, Source Types: StackEmpty
IL Offset: 0x25, Source Types: SourceTypeInvalid
IL Offset: 0x30, Source Types: StackEmpty
IL Offset: 0x44, Source Types: StackEmpty
IL Offset: 0xFFFFFFFD, Source Types: StackEmpty
IL Offset: 0xFFFFFFFE, Source Types: StackEmpty
IL Offset: 0x37, Source Types: StackEmpty
IL Offset: 0x3D, Source Types: StackEmpty
IL Offset: 0x43, Source Types: StackEmpty
IL Offset: 0xFFFFFFFD, Source Types: StackEmpty
Variable Locations:
Variable Number: 0
Start Offset: 0x0
End Offset: 0x39
Loc Type: VLT_REG
Register: RCX
Variable Number: 1
Start Offset: 0x0
End Offset: 0x39
Loc Type: VLT_REG
Register: RDX
Variable Number: 2
Start Offset: 0x0
End Offset: 0x39
Loc Type: VLT_REG
Register: R8
Variable Number: 3
Start Offset: 0x0
End Offset: 0x39
Loc Type: VLT_REG
Register: R9
Variable Number: 4
Start Offset: 0x0
End Offset: 0x39
Loc Type: VLT_STK
Base Register: RSP
Stack Offset: 40
Variable Number: 3
Start Offset: 0x39
End Offset: 0x53
Loc Type: VLT_REG
Register: RSI
Variable Number: 4
Start Offset: 0x39
End Offset: 0x5D
Loc Type: VLT_STK
Base Register: RBP
Stack Offset: 48
Variable Number: 1
Start Offset: 0x39
End Offset: 0x69
Loc Type: VLT_REG
Register: RDI
Variable Number: 2
Start Offset: 0x39
End Offset: 0x70
Loc Type: VLT_REG
Register: RBX
Variable Number: 0
Start Offset: 0x39
End Offset: 0xC4
Loc Type: VLT_STK
Base Register: RBP
Stack Offset: 16
Variable Number: 5
Start Offset: 0xBA
End Offset: 0xCC
Loc Type: VLT_REG
Register: RSI
push rbp
UWOP_PUSH_NONVOL RBP(5)
push r15
UWOP_PUSH_NONVOL R15(15)
push r14
UWOP_PUSH_NONVOL R14(14)
push r13
UWOP_PUSH_NONVOL R13(13)
push r12
UWOP_PUSH_NONVOL R12(12)
push rdi
UWOP_PUSH_NONVOL RDI(7)
push rsi
UWOP_PUSH_NONVOL RSI(6)
push rbx
UWOP_PUSH_NONVOL RBX(3)
sub rsp, 184
lea rbp, [rsp + 240]
xor eax, eax
mov qword ptr [rbp - 64], rax
mov qword ptr [rbp - 72], rax
mov qword ptr [rbp - 200], rsp
mov qword ptr [rbp + 16], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
lea rdx, [rbp - 64]
mov rcx, qword ptr [rbp + 16]
RCX is live
call qword ptr [Void System.Runtime.InteropServices.SafeHandle.DangerousAddRef(ref Boolean) (METHOD_ENTRY)]
RCX is dead
mov rax, qword ptr [rbp + 16]
RAX is live
mov r14, qword ptr [rax + 8]
mov qword ptr [rbp - 72], rsi
call qword ptr [Void System.StubHelpers.StubHelpers.ClearLastError() (METHOD_ENTRY)]
RSI is live
RAX is dead
mov r15, qword ptr [rbp + 48]
mov qword ptr [rsp + 32], r15
mov rcx, r14
mov qword ptr [rbp - 84], rcx
mov rdx, rdi
mov qword ptr [rbp - 92], rdx
mov r8d, ebx
mov dword ptr [rbp - 76], r8d
mov r9, rsi
mov qword ptr [rbp - 100], r9
lea rcx, [rbp - 192]
call qword ptr [PINVOKE_BEGIN (HELPER)]
mov rax, qword ptr [Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr) (INDIRECT_PINVOKE_TARGET)]
mov rcx, qword ptr [rbp - 84]
mov rdx, qword ptr [rbp - 92]
mov r8d, dword ptr [rbp - 76]
mov r9, qword ptr [rbp - 100]
call qword ptr [rax]
mov esi, eax
lea rcx, [rbp - 192]
call qword ptr [PINVOKE_END (HELPER)]
call qword ptr [Void System.StubHelpers.StubHelpers.SetLastError() (METHOD_ENTRY)]
nop
cmp byte ptr [rbp - 64], 0
je 0x00CC
mov rcx, qword ptr [rbp + 16]
RCX is live
xor edx, edx
sp+16 is dead
call qword ptr [Void System.Runtime.InteropServices.SafeHandle.InternalRelease(Boolean) (METHOD_ENTRY)]
RCX is dead
mov eax, esi
sp+16 is live
lea rsp, [rbp - 56]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Int32 Interop+Kernel32.ReadFile(System.Runtime.InteropServices.SafeHandle, Byte*, Int32, ref Int32, IntPtr)
Size: 68 bytes
Version: 1
Flags: 0x03 EHANDLER UHANDLER
SizeOfProlog: 0x0010
CountOfUnwindCodes: 9
FrameRegister: RAX
FrameOffset: 0x0
UnwindCode[0]: CodeOffset 0x0010 FrameOffset 0x6210 NextOffset 0x-1 Op 56
UnwindCode[1]: CodeOffset 0x000C FrameOffset 0x300C NextOffset 0x-1 Op RBX(3)
UnwindCode[2]: CodeOffset 0x000B FrameOffset 0x600B NextOffset 0x-1 Op RSI(6)
UnwindCode[3]: CodeOffset 0x000A FrameOffset 0x700A NextOffset 0x-1 Op RDI(7)
UnwindCode[4]: CodeOffset 0x0009 FrameOffset 0xC009 NextOffset 0x-1 Op R12(12)
UnwindCode[5]: CodeOffset 0x0007 FrameOffset 0xD007 NextOffset 0x-1 Op R13(13)
UnwindCode[6]: CodeOffset 0x0005 FrameOffset 0xE005 NextOffset 0x-1 Op R14(14)
UnwindCode[7]: CodeOffset 0x0003 FrameOffset 0xF003 NextOffset 0x-1 Op R15(15)
UnwindCode[8]: CodeOffset 0x0001 FrameOffset 0x5001 NextOffset 0x-1 Op RBP(5)
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 56
mov rbp, qword ptr [rcx + 40]
mov qword ptr [rsp + 40], rbp
lea rbp, [rbp + 240]
cmp byte ptr [rbp - 64], 0
je 0x0032
mov rcx, qword ptr [rbp + 16]
RCX is live
xor edx, edx
sp+16 is dead
call qword ptr [Void System.Runtime.InteropServices.SafeHandle.InternalRelease(Boolean) (METHOD_ENTRY)]
RCX is dead
nop
add rsp, 56
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment