| 65 | } |
| 66 | |
| 67 | void LibraryManager::FindLibrariesEoCPlugin() |
| 68 | { |
| 69 | uint8_t const prologue0[] = { |
| 70 | 0x40, 0x53, // push rbx |
| 71 | 0x48, 0x83, 0xEC, 0x20, // sub rsp, 20h |
| 72 | 0x8B, 0x05 // mov eax, cs:xxx |
| 73 | }; |
| 74 | |
| 75 | uint8_t const prologue1[] = { |
| 76 | 0x48, 0x8B, 0xD9, // mov rbx, rcx |
| 77 | 0x8B, 0xD0, // mov edx, eax |
| 78 | 0xFF, 0xC0, // inc eax |
| 79 | 0x89, 0x05 // mov cs:xxx, eax |
| 80 | }; |
| 81 | |
| 82 | uint8_t const prologue2[] = { |
| 83 | 0x85, 0xD2, // test edx, edx |
| 84 | 0x75, 0x18, // jnz short loc_xxx |
| 85 | 0x44, 0x8D, 0x42, // lea r8d, [rdx+XXh] |
| 86 | }; |
| 87 | |
| 88 | uint8_t const prologue3[] = { |
| 89 | 0x48, 0x8D, 0x15 // lea rdx, xxx |
| 90 | }; |
| 91 | |
| 92 | uint8_t const * p = (uint8_t const *)moduleStart_; |
| 93 | uint8_t const * moduleEnd = p + moduleSize_; |
| 94 | |
| 95 | for (; p < moduleEnd - 100; p++) { |
| 96 | if (*p == 0x40 |
| 97 | && memcmp(p, prologue0, sizeof(prologue0)) == 0 |
| 98 | && memcmp(p + 0x0C, prologue1, sizeof(prologue1)) == 0 |
| 99 | && memcmp(p + 0x19, prologue2, sizeof(prologue2)) == 0 |
| 100 | && memcmp(p + 0x21, prologue3, sizeof(prologue3)) == 0) { |
| 101 | int32_t rel1 = *(int32_t *)(p + 0x24); |
| 102 | int32_t rel2 = *(int32_t *)(p + 0x2B); |
| 103 | |
| 104 | uint8_t const * freeFunc = p + rel1 + 0x21 + 7; |
| 105 | uint8_t const * initFunc = p + rel2 + 0x28 + 7; |
| 106 | |
| 107 | auto it = libraries_.find(initFunc); |
| 108 | if (it != libraries_.end()) { |
| 109 | it->second.refs++; |
| 110 | } |
| 111 | else { |
| 112 | libraries_.insert(std::pair<uint8_t const *, EoCLibraryInfo>(initFunc, { initFunc, freeFunc, 1 })); |
| 113 | } |
| 114 | } |
| 115 | } |
| 116 | |
| 117 | #if 0 |
| 118 | Debug("LibraryManager::FindLibrariesEoCPlugin(): Found libraries:"); |
| 119 | for (auto const & v : libraries_) { |
| 120 | Debug("\t(Init %p; Dtor %p, Refs %d)!", v.second.initFunc, v.second.freeFunc, v.second.refs); |
| 121 | } |
| 122 | #endif |
| 123 | } |
| 124 | |