| 32 | |
| 33 | |
| 34 | void LibraryManager::FindMemoryManagerEoCApp() |
| 35 | { |
| 36 | Pattern p; |
| 37 | p.FromString( |
| 38 | "89 41 10 " // mov [rcx+10h], eax |
| 39 | "E8 XX XX XX XX " // call ls__GlobalAllocator__Free |
| 40 | "48 8B 47 08 " // mov rax, [rdi+8] |
| 41 | "BA 28 01 00 00 " // mov edx, 128h |
| 42 | "48 89 46 08 " // mov [rsi+8], rax |
| 43 | "48 C7 47 08 00 00 00 00 " // mov qword ptr [rdi+8], 0 |
| 44 | "C7 07 00 00 00 00 " // mov dword ptr [rdi], 0 |
| 45 | "E8 XX XX XX XX " // call ls__GlobalAllocator__Malloc |
| 46 | "33 D2 " // xor edx, edx |
| 47 | ); |
| 48 | |
| 49 | p.Scan(moduleStart_, moduleSize_, [this](const uint8_t * match) { |
| 50 | EoCAlloc = (EoCAllocFunc)AsmCallToAbsoluteAddress(match + 35); |
| 51 | EoCFree = (EoCFreeFunc)AsmCallToAbsoluteAddress(match + 3); |
| 52 | }); |
| 53 | |
| 54 | if (EoCAlloc == nullptr || EoCFree == nullptr) { |
| 55 | Debug("Could not find memory management functions"); |
| 56 | CriticalInitFailed = true; |
| 57 | } |
| 58 | } |
| 59 | |
| 60 | |
| 61 | void LibraryManager::FindLibrariesEoCApp() |
nothing calls this directly
no test coverage detected