| 19 | std::vector<BYTE> VMSection::getBytes() { return bytes; } |
| 20 | |
| 21 | void VMSection::addVmTramp(DWORD bytecodeRva) |
| 22 | { |
| 23 | addBytes({ 0x68 }); addBytes(convertToByteVector<DWORD>(bytecodeRva)); // push bytecodeRva |
| 24 | |
| 25 | DWORD relToEnterHandler = VM::getVmHandlerRva(ENTER) - fileOffsetToRva(writePointer + pointerToRawData + 5, virtualAddress, pointerToRawData); |
| 26 | |
| 27 | if (relToEnterHandler <= 127 && relToEnterHandler >= -128) |
| 28 | { |
| 29 | addBytes({ 0xEB, (BYTE)(relToEnterHandler & 0xFF) }); // jmp short vmenter |
| 30 | } |
| 31 | else |
| 32 | { |
| 33 | addBytes({ 0xE9 }); addBytes(convertToByteVector<DWORD>(relToEnterHandler)); // jmp far vmenter |
| 34 | } |
| 35 | } |
| 36 | |
| 37 | void VMSection::addBytes(std::vector<BYTE> bytes) |
| 38 | { |
no test coverage detected