| 307 | } |
| 308 | |
| 309 | void IATReferenceScan::patchDirectImportInMemory( IATReference * ref ) |
| 310 | { |
| 311 | DWORD patchBytes = 0; |
| 312 | BYTE patchPreBytes[2]; |
| 313 | |
| 314 | if (ref->targetPointer) |
| 315 | { |
| 316 | patchPreBytes[0] = 0xFF; |
| 317 | |
| 318 | if (ref->type == IAT_REFERENCE_DIRECT_CALL) //FF15 |
| 319 | { |
| 320 | patchPreBytes[1] = 0x15; |
| 321 | } |
| 322 | else if (ref->type == IAT_REFERENCE_DIRECT_JMP) //FF25 |
| 323 | { |
| 324 | patchPreBytes[1] = 0x25; |
| 325 | } |
| 326 | else |
| 327 | { |
| 328 | return; |
| 329 | } |
| 330 | |
| 331 | if (!JunkByteAfterInstruction) |
| 332 | { |
| 333 | ref->addressVA -= 1; |
| 334 | } |
| 335 | |
| 336 | ProcessAccessHelp::writeMemoryToProcess(ref->addressVA, 2, patchPreBytes); |
| 337 | |
| 338 | #ifdef _WIN64 |
| 339 | patchBytes = (DWORD)(ref->targetPointer - ref->addressVA - 6); |
| 340 | #else |
| 341 | patchBytes = ref->targetPointer; |
| 342 | #endif |
| 343 | ProcessAccessHelp::writeMemoryToProcess(ref->addressVA + 2, sizeof(DWORD), &patchBytes); |
| 344 | } |
| 345 | } |
| 346 | |
| 347 | DWORD_PTR IATReferenceScan::lookUpIatForPointer( DWORD_PTR addr ) |
| 348 | { |
nothing calls this directly
no outgoing calls
no test coverage detected