| 562 | } |
| 563 | |
| 564 | void CProcessInlineHookTable::CheckX64HookType1(cs_insn* insn, size_t j, size_t count, |
| 565 | ULONG_PTR moduleBase, size_t moduleSize, |
| 566 | ULONG_PTR base, size_t size) { |
| 567 | cs_detail* d1, * d2; |
| 568 | |
| 569 | d1 = insn[j].detail; |
| 570 | if (d1 == nullptr) |
| 571 | return; |
| 572 | |
| 573 | if (j + 1 >= count) |
| 574 | return; |
| 575 | d2 = insn[j + 1].detail; |
| 576 | if (d2 == nullptr) |
| 577 | return; |
| 578 | |
| 579 | if (d1->x86.op_count != 2) |
| 580 | return; |
| 581 | |
| 582 | cs_x86_op* op1, * op2; |
| 583 | op1 = &(d1->x86.operands[0]); |
| 584 | op2 = &(d2->x86.operands[1]); |
| 585 | |
| 586 | if (op1->type != x86_op_type::X86_OP_REG) |
| 587 | return; |
| 588 | |
| 589 | if (op1->access != CS_AC_WRITE) |
| 590 | return; |
| 591 | |
| 592 | if (op2->type != X86_OP_IMM) |
| 593 | return; |
| 594 | |
| 595 | if (op1->size != 8) |
| 596 | return; |
| 597 | |
| 598 | if (op2->size != 8) |
| 599 | return; |
| 600 | |
| 601 | if (strcmp(insn[j + 1].mnemonic, "jmp")) |
| 602 | return; |
| 603 | |
| 604 | if (d2->x86.op_count != 1) |
| 605 | return; |
| 606 | |
| 607 | if (d2->x86.operands[0].type != X86_OP_REG) |
| 608 | return; |
| 609 | |
| 610 | if (d2->x86.operands[0].access != CS_AC_READ) |
| 611 | return; |
| 612 | |
| 613 | ULONG_PTR targetAddress = d1->x86.operands[1].imm; |
| 614 | |
| 615 | if (targetAddress >= moduleBase && targetAddress <= moduleBase + moduleSize) |
| 616 | return; |
| 617 | |
| 618 | InlineHookInfo info; |
| 619 | info.TargetAddress = targetAddress; |
| 620 | info.TargetModule = L"Unknown"; |
| 621 | auto m = GetModuleByAddress(targetAddress); |