| 697 | } |
| 698 | |
| 699 | void CProcessInlineHookTable::CheckX64HookType4(cs_insn* insn, size_t j, size_t count, ULONG_PTR moduleBase, size_t moduleSize, |
| 700 | ULONG_PTR base, size_t size) { |
| 701 | cs_detail* d1, * d2; |
| 702 | d1 = insn[j].detail; |
| 703 | if (d1 == nullptr) |
| 704 | return; |
| 705 | if (j + 1 >= count) |
| 706 | return; |
| 707 | |
| 708 | if (d1->x86.opcode[0] == 0xEB) |
| 709 | return; |
| 710 | if (d1->x86.op_count != 1) |
| 711 | return; |
| 712 | if (d1->x86.operands[0].type != CS_OP_IMM) |
| 713 | return; |
| 714 | if (d1->x86.operands[0].size != 8) |
| 715 | return; |
| 716 | |
| 717 | if (strcmp(insn[j].mnemonic, "jmp")) |
| 718 | return; |
| 719 | |
| 720 | bool flag = true; |
| 721 | ULONG_PTR targetAddress = d1->x86.operands[0].imm; |
| 722 | ULONG_PTR address = base + size; |
| 723 | if (targetAddress >= base && targetAddress <= base + size) { |
| 724 | // �ų�ѭ����ת |
| 725 | return; |
| 726 | } |
| 727 | |
| 728 | // ���費���κδ���� |
| 729 | flag = true; |
| 730 | for (const auto& info : m_Items) { |
| 731 | if (targetAddress >= (ULONG_PTR)info->BaseAddress && targetAddress <= (ULONG_PTR)info->BaseAddress + info->RegionSize) { |
| 732 | flag = false; |
| 733 | } |
| 734 | } |
| 735 | if (flag) |
| 736 | return; |
| 737 | |
| 738 | flag = false; |
| 739 | for (const auto& m : m_Sys64Modules) { |
| 740 | // �ų�����API |
| 741 | if (targetAddress >= (ULONG_PTR)m->Base && targetAddress <= (ULONG_PTR)m->Base + m->ModuleSize) { |
| 742 | flag = true; |
| 743 | } |
| 744 | } |
| 745 | if (flag) { |
| 746 | return; |
| 747 | } |
| 748 | |
| 749 | // �ų��Ƿ���ַ |
| 750 | uint8_t code[7]; |
| 751 | SIZE_T dummy; |
| 752 | bool success = ::ReadProcessMemory(m_hProcess, (LPVOID)targetAddress, code, 6, &dummy); |
| 753 | if (!success) |
| 754 | return; |
| 755 | |
| 756 | cs_insn* jmpCode; |