| 302 | } |
| 303 | |
| 304 | void CProcessInlineHookTable::CheckX86HookType2(cs_insn* insn, size_t j, size_t count) { |
| 305 | cs_detail* d1, * d2; |
| 306 | |
| 307 | if (strcmp(insn[j].mnemonic, "push")) |
| 308 | return; |
| 309 | |
| 310 | |
| 311 | d1 = insn[j].detail; |
| 312 | if (d1 == nullptr) |
| 313 | return; |
| 314 | if (j + 1 >= count) { |
| 315 | return; |
| 316 | } |
| 317 | d2 = insn[j + 1].detail; |
| 318 | if (d2 == nullptr) |
| 319 | return; |
| 320 | |
| 321 | if (d1->x86.op_count != 1) |
| 322 | return; |
| 323 | if (d1->x86.operands[0].type != CS_OP_IMM) |
| 324 | return; |
| 325 | if (d1->x86.operands[0].size != 4) |
| 326 | return; |
| 327 | |
| 328 | if (strcmp(insn[j + 1].mnemonic, "ret")) |
| 329 | return; |
| 330 | |
| 331 | if (d2->x86.op_count != 0) |
| 332 | return; |
| 333 | |
| 334 | ULONG targetAddress = d1->x86.operands[0].imm; |
| 335 | SIZE_T size; |
| 336 | ULONG dummy; |
| 337 | bool success = ::ReadProcessMemory(m_hProcess, (LPVOID)targetAddress, &dummy, 4, &size); |
| 338 | if (!success) |
| 339 | return; |
| 340 | |
| 341 | InlineHookInfo info; |
| 342 | info.TargetAddress = targetAddress; |
| 343 | info.TargetModule = L"Unknown"; |
| 344 | auto m = GetModuleByAddress(targetAddress); |
| 345 | if (m != nullptr) { |
| 346 | info.TargetModule = m->Path; |
| 347 | } |
| 348 | info.Type = HookType::x86HookType2; |
| 349 | info.Address = insn[j].address; |
| 350 | m = GetModuleByAddress(info.Address); |
| 351 | info.Name = L"Unknown"; |
| 352 | if (m != nullptr) |
| 353 | info.Name = m->Name; |
| 354 | m_Table.data.info.push_back(info); |
| 355 | } |
| 356 | |
| 357 | void CProcessInlineHookTable::CheckX86HookType3(cs_insn* insn, size_t j, size_t count) { |
| 358 | cs_detail* d1, * d2; |