| 162 | // The `sub rsp, A0h` and `lea rbp,[rsp-47h]` combo is distinctive. |
| 163 | |
| 164 | static uintptr_t ResolveSerializeToArray() { |
| 165 | // Prologue saves + sub rsp (wildcard) + cookie xor (48 33 C4). |
| 166 | static const uint8_t pat[] = { |
| 167 | 0x48, 0x89, 0x5C, 0x24, 0x18, // mov [rsp+18h], rbx |
| 168 | 0x55, // push rbp |
| 169 | 0x56, // push rsi |
| 170 | 0x57, // push rdi |
| 171 | 0x48, 0x81, 0xEC, 0x00, 0x00, 0x00, 0x00, // sub rsp, ?? (wildcard) |
| 172 | 0x48, 0x8B, 0x05, 0x00, 0x00, 0x00, 0x00, // mov rax, cs:cookie (wildcard) |
| 173 | 0x48, 0x33, 0xC4, // xor rax, rsp |
| 174 | }; |
| 175 | static const char mask[] = "xxxxxxxxxxx????xxx????xxx"; |
| 176 | |
| 177 | uintptr_t result = SigScanner::FindPattern(pat, mask, 25); |
| 178 | if (result) |
| 179 | LOG("[Resolver] SerializeToArray @ %p (RVA 0x%llX) via signature", |
| 180 | (void*)result, (uint64_t)(result - SigScanner::GetImageBase())); |
| 181 | else |
| 182 | LOG("[Resolver] SerializeToArray: signature not found"); |
| 183 | return result; |
| 184 | } |
| 185 | |
| 186 | static uintptr_t ResolveParseFromArray(uintptr_t serializeAddr) { |
| 187 | // Scan backward from SerializeToArray. Wildcard the lea displacement. |
no test coverage detected