| 251 | } |
| 252 | |
| 253 | bool DetourDoesCodeEndFunction(PUCHAR pCode) { |
| 254 | if (pCode[0] == 0xeb || // jmp +imm8 |
| 255 | pCode[0] == 0xe9 || // jmp +imm32 |
| 256 | pCode[0] == 0xe0 || // jmp eax |
| 257 | pCode[0] == 0xc2 || // ret +imm8 |
| 258 | pCode[0] == 0xc3 || // ret |
| 259 | pCode[0] == 0xcc) { // brk |
| 260 | return TRUE; |
| 261 | } |
| 262 | else if (pCode[0] == 0xf3 && pCode[1] == 0xc3) { // rep ret |
| 263 | return TRUE; |
| 264 | } |
| 265 | else if (pCode[0] == 0xff && pCode[1] == 0x25) { // jmp [+imm32] |
| 266 | return TRUE; |
| 267 | } |
| 268 | else if ((pCode[0] == 0x26 || // jmp es: |
| 269 | pCode[0] == 0x2e || // jmp cs: |
| 270 | pCode[0] == 0x36 || // jmp ss: |
| 271 | pCode[0] == 0x3e || // jmp ds: |
| 272 | pCode[0] == 0x64 || // jmp fs: |
| 273 | pCode[0] == 0x65) && // jmp gs: |
| 274 | pCode[1] == 0xff && // jmp [+imm32] |
| 275 | pCode[2] == 0x25) { |
| 276 | return TRUE; |
| 277 | } |
| 278 | return FALSE; |
| 279 | } |
| 280 | |
| 281 | ULONG DetourIsCodeFiller(PUCHAR pCode) { |
| 282 | // 1-byte through 11-byte NOPs. |