| 422 | } |
| 423 | |
| 424 | void CProcessInlineHookTable::CheckX86HookType6(cs_insn* insn, size_t j, size_t count) { |
| 425 | if (strcmp(insn[j].mnemonic, "jmp")) |
| 426 | return; |
| 427 | |
| 428 | cs_detail* d1, * d2; |
| 429 | |
| 430 | d1 = insn[j].detail; |
| 431 | if (d1 == nullptr) |
| 432 | return; |
| 433 | if (j + 1 >= count) { |
| 434 | return; |
| 435 | } |
| 436 | d2 = insn[j + 1].detail; |
| 437 | if (d2 == nullptr) |
| 438 | return; |
| 439 | |
| 440 | if (d2->x86.opcode[0] != 0xE8) |
| 441 | return; |
| 442 | |
| 443 | if (strcmp(insn[j + 1].mnemonic, "jmp")) |
| 444 | return; |
| 445 | |
| 446 | if (d1->x86.op_count != 1) |
| 447 | return; |
| 448 | if (d1->x86.operands[0].type != CS_OP_IMM) |
| 449 | return; |
| 450 | if (d1->x86.operands[0].size != 4) |
| 451 | return; |
| 452 | |
| 453 | if (d2->x86.operands[0].type != CS_OP_IMM) |
| 454 | return; |
| 455 | |
| 456 | if (d2->x86.operands[0].size != 4) |
| 457 | return; |
| 458 | |
| 459 | ULONG_PTR targetAddress = d2->x86.operands[0].imm; |
| 460 | InlineHookInfo info; |
| 461 | info.TargetAddress = targetAddress; |
| 462 | info.TargetModule = L"Unknown"; |
| 463 | auto m = GetModuleByAddress(targetAddress); |
| 464 | if (m != nullptr) { |
| 465 | info.TargetModule = m->Path; |
| 466 | } |
| 467 | info.Type = HookType::x86HookType3; |
| 468 | info.Address = insn[j].address; |
| 469 | m = GetModuleByAddress(info.Address); |
| 470 | info.Name = L"Unknown"; |
| 471 | if (m != nullptr) |
| 472 | info.Name = m->Name; |
| 473 | m_Table.data.info.push_back(info); |
| 474 | } |
| 475 | |
| 476 | void CProcessInlineHookTable::CheckInlineHook(uint8_t* code, size_t codeSize, uint64_t address, ULONG_PTR moduleBase, SIZE_T moduleSize) { |
| 477 | // �����ʱ��ϳ�������£��ῨUI |