| 203 | } |
| 204 | |
| 205 | void IATReferenceScan::findNormalIatReference( _DInst * instruction ) |
| 206 | { |
| 207 | #ifdef DEBUG_COMMENTS |
| 208 | _DecodedInst inst; |
| 209 | #endif |
| 210 | |
| 211 | IATReference ref; |
| 212 | |
| 213 | |
| 214 | if (META_GET_FC(instruction->meta) == FC_CALL || META_GET_FC(instruction->meta) == FC_UNC_BRANCH) |
| 215 | { |
| 216 | if (instruction->size >= 5) |
| 217 | { |
| 218 | if (META_GET_FC(instruction->meta) == FC_CALL) |
| 219 | { |
| 220 | ref.type = IAT_REFERENCE_PTR_CALL; |
| 221 | } |
| 222 | else |
| 223 | { |
| 224 | ref.type = IAT_REFERENCE_PTR_JMP; |
| 225 | } |
| 226 | ref.addressVA = (DWORD_PTR)instruction->addr; |
| 227 | ref.instructionSize = instruction->size; |
| 228 | |
| 229 | #ifdef _WIN64 |
| 230 | if (instruction->flags & FLAG_RIP_RELATIVE) |
| 231 | { |
| 232 | |
| 233 | #ifdef DEBUG_COMMENTS |
| 234 | distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst); |
| 235 | Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, (DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, INSTRUCTION_GET_RIP_TARGET(instruction)); |
| 236 | #endif |
| 237 | |
| 238 | if (INSTRUCTION_GET_RIP_TARGET(instruction) >= IatAddressVA && INSTRUCTION_GET_RIP_TARGET(instruction) < (IatAddressVA + IatSize)) |
| 239 | { |
| 240 | ref.targetPointer = INSTRUCTION_GET_RIP_TARGET(instruction); |
| 241 | |
| 242 | getIatEntryAddress(&ref); |
| 243 | |
| 244 | //Scylla::debugLog.log(L"iat entry "PRINTF_DWORD_PTR_FULL,ref.targetAddressInIat); |
| 245 | |
| 246 | iatReferenceList.push_back(ref); |
| 247 | } |
| 248 | } |
| 249 | #else |
| 250 | |
| 251 | if (instruction->ops[0].type == O_DISP) |
| 252 | { |
| 253 | //jmp dword ptr || call dword ptr |
| 254 | #ifdef DEBUG_COMMENTS |
| 255 | distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst); |
| 256 | Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, (DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, instruction->disp); |
| 257 | #endif |
| 258 | |
| 259 | if (instruction->disp >= IatAddressVA && instruction->disp < (IatAddressVA + IatSize)) |
| 260 | { |
| 261 | ref.targetPointer = (DWORD_PTR)instruction->disp; |
| 262 | |