| 452 | } |
| 453 | |
| 454 | void LibraryManager::FindStatusMachineEoCPlugin() |
| 455 | { |
| 456 | Pattern p; |
| 457 | p.FromString( |
| 458 | "83 7A 1C 00 " // cmp dword ptr [rdx+1Ch], 0 |
| 459 | "48 8B F2 " // mov rsi, rdx |
| 460 | "4C 8B F1 " // mov r14, rcx |
| 461 | "7E 7E " // jle short xxx |
| 462 | "4C 8B 05 XX XX XX XX " // mov r8, cs:?Unassigned@ObjectHandle@ls@@2V12@B |
| 463 | "48 8D 15 XX XX XX XX " // lea rdx, fs_LIFESTEAL |
| 464 | "48 89 5C 24 30 " // mov [rsp+28h+arg_0], rbx |
| 465 | "48 89 7C 24 40 " // mov [rsp+28h+arg_10], rdi |
| 466 | "48 8B B9 B0 01 00 00 " // mov rdi, [rcx+1B0h] |
| 467 | "4D 8B 00 " // mov r8, [r8] |
| 468 | "48 8B CF " // mov rcx, rdi |
| 469 | "E8 XX XX XX XX " // call esv__StatusMachine__CreateStatus |
| 470 | ); |
| 471 | |
| 472 | uint8_t const * lastMatch; |
| 473 | p.Scan(moduleStart_, moduleSize_, [this, &lastMatch](const uint8_t * match) { |
| 474 | auto fsx = AsmLeaToAbsoluteAddress(match + 19); |
| 475 | if (IsFixedStringRef(fsx, "LIFESTEAL")) { |
| 476 | auto actionAddr = AsmCallToAbsoluteAddress(match + 49); |
| 477 | lastMatch = match + 55; |
| 478 | StatusMachineCreateStatus = (esv::StatusMachine__CreateStatus)actionAddr; |
| 479 | } |
| 480 | }); |
| 481 | |
| 482 | if (StatusMachineCreateStatus == nullptr) { |
| 483 | Debug("LibraryManager::FindStatusMachineEoCPlugin(): Could not find StatusMachine::CreateStatus"); |
| 484 | InitFailed = true; |
| 485 | } |
| 486 | |
| 487 | Pattern p2; |
| 488 | p2.FromString( |
| 489 | "C7 43 2C 00 00 00 00 " // mov dword ptr [rbx+2Ch], 0 |
| 490 | "48 8B CF " // mov rcx, rdi |
| 491 | "E8 XX XX XX XX " // call esv__StatusMachine__ApplyStatus |
| 492 | "48 8B 7C 24 40 " // mov rdi, [rsp+28h+arg_10] |
| 493 | ); |
| 494 | |
| 495 | p2.Scan(lastMatch, 0x100, [this](const uint8_t * match) { |
| 496 | auto actionAddr = AsmCallToAbsoluteAddress(match + 10); |
| 497 | StatusMachineApplyStatus = (esv::StatusMachine__ApplyStatus)actionAddr; |
| 498 | }); |
| 499 | |
| 500 | if (StatusMachineApplyStatus == nullptr) { |
| 501 | Debug("LibraryManager::FindStatusMachineEoCPlugin(): Could not find StatusMachine::ApplyStatus"); |
| 502 | InitFailed = true; |
| 503 | } |
| 504 | } |
| 505 | |
| 506 | void LibraryManager::FindStatusTypesEoCPlugin() |
| 507 | { |
nothing calls this directly
no test coverage detected