Distorm for C#/.NET (Distorm.cs)

/**
 * A C#/.NET implementation of distorm, a powerful disassembler library for x86/AMD64
 *
 * To obtain distorm32.dll and distorm64.dll:
 *
 * distorm32: Get distorm3 sources, change target name to distorm32, UNDEFINE SUPPORT_64BIT_OFFSET
 * distorm64: Get distorm3 sources, change target name to distorm64, define SUPPORT_64BIT_OFFSET
 *
 * Sample usages:
 *    var d32 = new Distorm<ArchitectureIA32>();
 *    or
 *    var d64 = new Distorm<ArchitectureX64>();
 *    and
 *    replace in Distorm class instanciation the pointer "hereYourFunctionPointer" to your needs
 *
 * Sample by Arnaud Dovi - https://www.ohloh.net/accounts/class101
 *
 **/

using System;
using System.Runtime.InteropServices;
using ArchC = yourNameSpace.ArchitectureCommon;

// ReSharper disable CheckNamespace

namespace yourNameSpace // ReSharper restore CheckNamespace
{
    // ReSharper disable InconsistentNaming
    internal class Distorm<ArchT> where ArchT : ArchitectureCommon, new() // ReSharper restore InconsistentNaming
    {
        private readonly ArchT _arch = new ArchT();

        internal Distorm()
        {
            uint instructionCount;
            object instructions = null;
            IntPtr hereYourFunctionPointer;
            ArchitectureCommon.DecodeResult result = _arch.distorm_decode(IntPtr.Zero, hereYourFunctionPointer, 20, ref instructions, ArchC.MaxInstructions, out instructionCount);
            if (result != ArchitectureCommon.DecodeResult.DECRES_SUCCESS) return;
        }
    }

    internal abstract class ArchitectureCommon
    {
        internal const uint MaxInstructions = 20;
        internal abstract DecodeResult distorm_decode(IntPtr codeOffset, IntPtr codePtr, int codeLen, ref object instructions, uint maxInstructions, out uint usedInstructionsCount);

        [Flags]
        internal enum DecodeResult // ReSharper disable InconsistentNaming
        {
            DECRES_NONE = 0,
            DECRES_SUCCESS = 1,
            DECRES_MEMORYERR = 2,
            DECRES_INPUTERR = 3,
            DECRES_FILTERED = 4
        }

        // ReSharper restore InconsistentNaming

        [Flags]
        internal enum DecodeType
        {
            Decode16Bits = 0,
            Decode32Bits = 1,
            Decode64Bits = 2
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
        internal struct WString
        {
            internal uint length;
            [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 48)] internal string p; /* p is a null terminated string. */
        }
    }

    internal class ArchitectureIA32 : ArchitectureCommon
    {
        private const DecodeType DisasmType = DecodeType.Decode32Bits;

        // ReSharper disable RedundantAssignment
        internal override DecodeResult distorm_decode(IntPtr codeOffset, IntPtr codePtr, int codeLen, ref object instructions, uint maxInstructions, out uint usedInstructionsCount) // ReSharper restore RedundantAssignment
        {
            instructions = new DecodedInst[MaxInstructions];
            return distorm_decode32((uint) codeOffset, (uint) codePtr, codeLen, DisasmType, (DecodedInst[]) instructions, maxInstructions, out usedInstructionsCount);
        }

        [DllImport("distorm32.dll", SetLastError = true, CallingConvention = CallingConvention.Cdecl, EntryPoint = "distorm_decode32", CharSet = CharSet.Ansi)]
        private static extern DecodeResult distorm_decode32(uint codeOffset, uint codePtr, int codeLen, DecodeType disasmType, [Out, MarshalAs(UnmanagedType.LPArray)] DecodedInst[] result, uint maxInstructions,
                                                            out uint usedInstructionsCount);

        [StructLayout(LayoutKind.Sequential)]
        internal struct DecodedInst
        {
            internal readonly WString mnemonic;
            /* Mnemonic of decoded instruction, prefixed if required by REP, LOCK etc. */

            internal readonly WString operands;
            /* Operands of the decoded instruction, up to 3 operands, comma-seperated. */

            internal readonly WString instructionHex; /* Hex dump - little endian, including prefixes. */
            internal readonly uint size; /* Size of decoded instruction. */
            internal readonly uint offset; /* 32-bit unsigned integer start offset of the decoded instruction. */
        }
    }

    internal class ArchitectureX64 : ArchitectureIA32
    {
        private const DecodeType DisasmType = DecodeType.Decode64Bits;

        // ReSharper disable RedundantAssignment
        internal override DecodeResult distorm_decode(IntPtr codeOffset, IntPtr codePtr, int codeLen, ref object instructions, uint maxInstructions, out uint usedInstructionsCount) // ReSharper restore RedundantAssignment
        {
            instructions = new DecodedInst[MaxInstructions];
            return distorm_decode64((ulong) codeOffset, (ulong) codePtr, codeLen, DisasmType, (DecodedInst[]) instructions, maxInstructions, out usedInstructionsCount);
        }

        [DllImport("distorm64.dll", SetLastError = true, CallingConvention = CallingConvention.Cdecl, EntryPoint = "distorm_decode64", CharSet = CharSet.Ansi)]
        private static extern DecodeResult distorm_decode64(ulong codeOffset, ulong codePtr, int codeLen, DecodeType disasmType, [Out, MarshalAs(UnmanagedType.LPArray)] DecodedInst[] result, uint maxInstructions,
                                                            out uint usedInstructionsCount);

        [StructLayout(LayoutKind.Sequential)]
        internal new struct DecodedInst
        {
            internal readonly WString mnemonic;
            /* Mnemonic of decoded instruction, prefixed if required by REP, LOCK etc. */

            internal readonly WString operands;
            /* Operands of the decoded instruction, up to 3 operands, comma-seperated. */

            internal readonly WString instructionHex; /* Hex dump - little endian, including prefixes. */
            internal readonly uint size; /* Size of decoded instruction. */
            internal readonly ulong offset; /* 64-bit unsigned integer start offset of the decoded instruction. */
        }
    }
}