| 244 | } |
| 245 | |
| 246 | void CProcessInlineHookTable::CheckX86HookType1(cs_insn* insn, size_t j, size_t count, ULONG_PTR moduleBase, SIZE_T moduleSize) { |
| 247 | cs_detail* d1, * d2; |
| 248 | d1 = insn[j].detail; |
| 249 | if (d1 == nullptr) |
| 250 | return; |
| 251 | if (d1->x86.op_count != 1) |
| 252 | return; |
| 253 | |
| 254 | if (d1->x86.operands[0].type != CS_OP_IMM) |
| 255 | return; |
| 256 | |
| 257 | if (d1->x86.operands[0].size != 4) |
| 258 | return; |
| 259 | |
| 260 | if (strcmp(insn[j].mnemonic, "jmp")) |
| 261 | return; |
| 262 | |
| 263 | if (d1->x86.opcode[0] != 0xE9) |
| 264 | return; |
| 265 | |
| 266 | int flag = true; |
| 267 | |
| 268 | ULONG_PTR targetAddress = d1->x86.operands[0].imm; |
| 269 | |
| 270 | if (!IsInCodeBlock(targetAddress)) |
| 271 | return; |
| 272 | |
| 273 | if (targetAddress >= moduleBase && targetAddress <= moduleBase + moduleSize) |
| 274 | return; |
| 275 | |
| 276 | flag = false; |
| 277 | |
| 278 | for (const auto& m : m_Sys32Modules) { |
| 279 | //printf("path: %ws\n", m->Path.c_str()); |
| 280 | if (targetAddress >= (ULONG_PTR)m->Base && targetAddress <= (ULONG_PTR)m->Base + m->ModuleSize) { |
| 281 | flag = true; |
| 282 | } |
| 283 | } |
| 284 | if (flag) { |
| 285 | return; |
| 286 | } |
| 287 | |
| 288 | InlineHookInfo info; |
| 289 | info.TargetAddress = targetAddress; |
| 290 | info.TargetModule = L"Unknown"; |
| 291 | auto m = GetModuleByAddress(targetAddress); |
| 292 | if (m != nullptr) { |
| 293 | info.TargetModule = m->Path; |
| 294 | } |
| 295 | info.Type = HookType::x86HookType1; |
| 296 | info.Address = insn[j].address; |
| 297 | m = GetModuleByAddress(info.Address); |
| 298 | info.Name = L"Unknown"; |
| 299 | if (m != nullptr) |
| 300 | info.Name = m->Name; |
| 301 | m_Table.data.info.push_back(info); |
| 302 | } |
| 303 | |