MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / CheckX64HookType4

Method CheckX64HookType4

WinArk/ProcessInlineHookTable.cpp:699–790  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

697}
698
699void CProcessInlineHookTable::CheckX64HookType4(cs_insn* insn, size_t j, size_t count, ULONG_PTR moduleBase, size_t moduleSize,
700 ULONG_PTR base, size_t size) {
701 cs_detail* d1, * d2;
702 d1 = insn[j].detail;
703 if (d1 == nullptr)
704 return;
705 if (j + 1 >= count)
706 return;
707
708 if (d1->x86.opcode[0] == 0xEB)
709 return;
710 if (d1->x86.op_count != 1)
711 return;
712 if (d1->x86.operands[0].type != CS_OP_IMM)
713 return;
714 if (d1->x86.operands[0].size != 8)
715 return;
716
717 if (strcmp(insn[j].mnemonic, "jmp"))
718 return;
719
720 bool flag = true;
721 ULONG_PTR targetAddress = d1->x86.operands[0].imm;
722 ULONG_PTR address = base + size;
723 if (targetAddress >= base && targetAddress <= base + size) {
724 // �ų�ѭ����ת
725 return;
726 }
727
728 // ���費���κδ����
729 flag = true;
730 for (const auto& info : m_Items) {
731 if (targetAddress >= (ULONG_PTR)info->BaseAddress && targetAddress <= (ULONG_PTR)info->BaseAddress + info->RegionSize) {
732 flag = false;
733 }
734 }
735 if (flag)
736 return;
737
738 flag = false;
739 for (const auto& m : m_Sys64Modules) {
740 // �ų�����API
741 if (targetAddress >= (ULONG_PTR)m->Base && targetAddress <= (ULONG_PTR)m->Base + m->ModuleSize) {
742 flag = true;
743 }
744 }
745 if (flag) {
746 return;
747 }
748
749 // �ų��Ƿ���ַ
750 uint8_t code[7];
751 SIZE_T dummy;
752 bool success = ::ReadProcessMemory(m_hProcess, (LPVOID)targetAddress, code, 6, &dummy);
753 if (!success)
754 return;
755
756 cs_insn* jmpCode;

Callers

nothing calls this directly

Calls 1

push_backMethod · 0.80

Tested by

no test coverage detected