|
Hi visu
I assume that your program is running in debug mode.Run for a single step event
then decrease values of EIP from CONTEXT(using GetThreadContext).This will be
size.
If your proram is not running(like disassembler) you should use the cpu reference
for instruction structure because the indtruction lengths are various(1-14 byte
for intel)
sincerely yours
__________________
I should look out my posts,or JMI gets mad on me! 
|