| 633 | |
| 634 | |
| 635 | void CProcessInlineHookTable::CheckX64HookType2(cs_insn* insn, size_t j, size_t count) { |
| 636 | cs_detail* d1, * d2; |
| 637 | d1 = insn[j].detail; |
| 638 | if (j + 1 >= count) { |
| 639 | return; |
| 640 | } |
| 641 | d2 = insn[j + 1].detail; |
| 642 | if (d2 == nullptr) |
| 643 | return; |
| 644 | |
| 645 | if (strcmp(insn[j].mnemonic, "push")) { |
| 646 | return; |
| 647 | } |
| 648 | if (j + 2 >= count) { |
| 649 | return; |
| 650 | } |
| 651 | |
| 652 | if (strcmp(insn[j + 2].mnemonic, "ret")) { |
| 653 | return; |
| 654 | } |
| 655 | |
| 656 | if (d1->regs_read_count != 1) |
| 657 | return; |
| 658 | |
| 659 | if (strcmp("rsp", cs_reg_name(_x64handle, d1->regs_read[0]))) |
| 660 | return; |
| 661 | |
| 662 | if (d1->x86.op_count != 1 || d1->x86.operands[0].size != 8) |
| 663 | return; |
| 664 | |
| 665 | if (d2->x86.op_count != 2) |
| 666 | return; |
| 667 | |
| 668 | if (d2->x86.operands[0].access != CS_AC_WRITE) |
| 669 | return; |
| 670 | |
| 671 | |
| 672 | if (d2->x86.operands[1].type != CS_OP_IMM) |
| 673 | return; |
| 674 | |
| 675 | if (d2->x86.operands[1].size != 4 || d2->x86.operands[0].size != 4) |
| 676 | return; |
| 677 | |
| 678 | if (d2->x86.operands[0].mem.base != X86_REG_RSP) |
| 679 | return; |
| 680 | |
| 681 | InlineHookInfo info; |
| 682 | ULONG lowAddr = d1->x86.operands[0].imm; |
| 683 | ULONG highAddr = d2->x86.operands[1].imm; |
| 684 | info.TargetAddress = ((ULONG_PTR)highAddr << 32) | lowAddr; |
| 685 | info.TargetModule = L"Unknown"; |
| 686 | auto m = GetModuleByAddress(info.TargetAddress); |
| 687 | if (m != nullptr) { |
| 688 | info.TargetModule = m->Path; |
| 689 | } |
| 690 | info.Type = HookType::x64HookType2; |
| 691 | info.Address = insn[j].address; |
| 692 | m = GetModuleByAddress(info.Address); |