| 228 | } |
| 229 | |
| 230 | inline BOOL detour_does_code_end_function(PBYTE pbCode) |
| 231 | { |
| 232 | if (pbCode[0] == 0xeb || // jmp +imm8 |
| 233 | pbCode[0] == 0xe9 || // jmp +imm32 |
| 234 | pbCode[0] == 0xe0 || // jmp eax |
| 235 | pbCode[0] == 0xc2 || // ret +imm8 |
| 236 | pbCode[0] == 0xc3 || // ret |
| 237 | pbCode[0] == 0xcc) { // brk |
| 238 | return TRUE; |
| 239 | } |
| 240 | else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret |
| 241 | return TRUE; |
| 242 | } |
| 243 | else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32] |
| 244 | return TRUE; |
| 245 | } |
| 246 | else if ((pbCode[0] == 0x26 || // jmp es: |
| 247 | pbCode[0] == 0x2e || // jmp cs: |
| 248 | pbCode[0] == 0x36 || // jmp ss: |
| 249 | pbCode[0] == 0x3e || // jmp ds: |
| 250 | pbCode[0] == 0x64 || // jmp fs: |
| 251 | pbCode[0] == 0x65) && // jmp gs: |
| 252 | pbCode[1] == 0xff && // jmp [+imm32] |
| 253 | pbCode[2] == 0x25) { |
| 254 | return TRUE; |
| 255 | } |
| 256 | return FALSE; |
| 257 | } |
| 258 | |
| 259 | inline ULONG detour_is_code_filler(PBYTE pbCode) |
| 260 | { |
no test coverage detected
searching dependent graphs…