Русский   Home

RegisterAddr method

This method registers a function by its memory address. The other parameters are the same as those of Register.

DWX.RegisterAddr(Address, "FuncName", "i=hwwu", "r=l");

RegisterCode method

The 1st parameter of this method takes the machine code of a function in the form of a hex string. The other parameters are the same as those of Register.

DWX = new ActiveXObject("DynamicWrapperX");
if (DWX.Bitness == 32) {
    // The function multiplies its arguments and returns the result.
    Code = "8B442404F76C2408C3"
}
else {
    Code = "4889C8 48F7EA C3" // mov rax,rcx; imul rdx; ret
}
CodeAddr = DWX.RegisterCode(Code, "Multiply", "i=ll", "r=l");
WScript.Echo(DWX.Multiply(5, 4));

Remarks

• Memory is allocated and the code is written to it in binary form. After that, you can call it by the name specified in the 2nd parameter. The method returns the address of the code. Machine code is different for x86 and x64, hence the need to check the bitness of the process (via checking the DynamicWrapperX object's bitness) to figure out which version of the code to use. One possible application for machine code functions is processing large amounts of data, where machine code may run tens or even hundreds of times faster than script code.
• If you want to use the code by its address, without creating a new method, you can omit all arguments except the 1st one. But keep in mind that the memory allocated for the code is still connected with the object and will be freed if the object is released.
• The hex string can be continuous or divided into parts by spaces, tabs, or newlines. You can also insert comments right in the hex string, surrounding them with parentheses.

  Code = "4889C8 (mov rax,rcx) 48F7EA (imul rdx) C3 (ret)"
  

• If the hex string is multiline, you can mark comments with a semicolon.

  Code = "4889C8 ; mov rax,rcx \n" +
         "48F7EA ; imul rdx \n" +
         "C3     ; ret"
  

  But note that in this case each line (except the last one) must have a newline character or characters at the end because they are used as the end-of-comment marker.