| 200 | } |
| 201 | |
| 202 | void * OsirisWrappers::FindRuleActionCallProc() |
| 203 | { |
| 204 | #if 0 |
| 205 | Debug("OsirisWrappers::FindRuleActionCallProc"); |
| 206 | #endif |
| 207 | uint8_t * Addr = static_cast<uint8_t *>(OsirisDllStart); |
| 208 | |
| 209 | // Function prologue of RuleAction::Call |
| 210 | static const uint8_t instructions[18] = { |
| 211 | 0x40, 0x55, // push rbp |
| 212 | 0x53, // push rbx |
| 213 | 0x56, // push rsi |
| 214 | 0x41, 0x56, // push r14 |
| 215 | 0x48, 0x8D, 0x6C, 0x24, 0xC1, // lea rbp, [rsp-3Fh] |
| 216 | 0x48, 0x81, 0xEC, 0x88, 0x00, 0x00, 0x00 // sub rsp, 88h |
| 217 | }; |
| 218 | |
| 219 | // Look for prologue in the entire osiris DLL |
| 220 | for (uint8_t * ptr = Addr; ptr < Addr + OsirisDllSize; ptr++) |
| 221 | { |
| 222 | if (*reinterpret_cast<uint64_t *>(ptr) == *reinterpret_cast<uint64_t const *>(&instructions[0]) |
| 223 | && memcmp(instructions, ptr, sizeof(instructions)) == 0) |
| 224 | { |
| 225 | return ptr; |
| 226 | } |
| 227 | } |
| 228 | |
| 229 | return nullptr; |
| 230 | } |
| 231 | |
| 232 | uint8_t * ResolveRealFunctionAddress(uint8_t * Address) |
| 233 | { |