| 230 | } |
| 231 | |
| 232 | uint8_t * ResolveRealFunctionAddress(uint8_t * Address) |
| 233 | { |
| 234 | // Resolve function pointer through relocations |
| 235 | for (uint8_t * ptr = Address; ptr < Address + 64; ptr++) |
| 236 | { |
| 237 | // Look for the instruction "cmp qword ptr [rip+xxxxxx], 0" |
| 238 | if (ptr[0] == 0x48 && ptr[1] == 0x83 && ptr[2] == 0x3d && ptr[6] == 0x00 && |
| 239 | // Look for the instruction "jmp xxxx" |
| 240 | ptr[13] == 0xe9) |
| 241 | { |
| 242 | int32_t relOffset = *reinterpret_cast<int32_t *>(ptr + 14); |
| 243 | return ptr + relOffset + 18; |
| 244 | } |
| 245 | } |
| 246 | |
| 247 | // Could not find any relocations |
| 248 | return Address; |
| 249 | } |
| 250 | |
| 251 | void OsirisWrappers::FindOsirisGlobals(FARPROC CtorProc) |
| 252 | { |
no outgoing calls
no test coverage detected