| 300 | } |
| 301 | |
| 302 | void OsirisWrappers::FindDebugFlags(FARPROC SetOptionProc) |
| 303 | { |
| 304 | uint8_t * Addr = ResolveRealFunctionAddress((uint8_t *)SetOptionProc); |
| 305 | |
| 306 | // Try to find pointer of global var DebugFlags |
| 307 | for (uint8_t * ptr = Addr; ptr < Addr + 0x80; ptr++) |
| 308 | { |
| 309 | // Look for the instruction "mov ecx, cs:xxx" |
| 310 | if (ptr[0] == 0x8B && ptr[1] == 0x0D && |
| 311 | // Look for the instruction "shr e*x, 14h" |
| 312 | ptr[8] == 0xC1 && ptr[10] == 0x14) |
| 313 | { |
| 314 | int32_t relOffset = *reinterpret_cast<int32_t *>(ptr + 2); |
| 315 | uint64_t dbgPtr = (uint64_t)ptr + relOffset + 6; |
| 316 | Globals.DebugFlags = (DebugFlag *)dbgPtr; |
| 317 | break; |
| 318 | } |
| 319 | } |
| 320 | |
| 321 | if (Globals.DebugFlags == nullptr) { |
| 322 | Fail("Could not locate global variable DebugFlags"); |
| 323 | } |
| 324 | |
| 325 | #if 0 |
| 326 | Debug("OsirisProxy::FindDebugFlags: DebugFlags = %p", Globals.DebugFlags); |
| 327 | #endif |
| 328 | } |
| 329 | |
| 330 | } |
nothing calls this directly
no test coverage detected