5template <
typename DELTA_T>
76 if (!peconv::validate_ptr(this->patchedCode, this->codeSize,
jmp_ptr, 2)) {
88 std::cerr <<
"It is not MOV->JMP" << std::hex << (DWORD)
jmp_ptr[0] << std::endl;
95 std::cerr <<
"MOV->JMP : reg mismatch" << std::endl;
111 std::cout <<
"----> Target: " << std::hex <<
addr << std::endl;
134 if (!isModule64bit)
return false;
135 if (
op >= 0x40 &&
op <= 0x4F) {
143 if (!isModule64bit)
return false;
144 if (
op >= 0x48 &&
op <= 0x4F) {
153 if (
op == OP_JMP ||
op == OP_CALL_DWORD) {
156 if (
op == OP_SHORTJMP) {
159 if (
op == OP_PUSH_DWORD) {
162 if (
op == OP_JMP_VIA_ADDR_B1 &&
patch_ptr[1] == OP_JMP_VIA_ADDR_B2) {
167 if (is64Modifier(
op)) {
168 if (isLongModifier(
op)) {
174 if (
op >= 0xB8 &&
op <= 0xBF) {
182 if (this->relocs.find(
patch.startRva) ==
this->relocs.end()) {
186 const size_t fieldSize = (this->moduleData.is64bit()) ?
sizeof(
ULONGLONG) :
sizeof(DWORD);
206 if (!peconv::validate_ptr(this->patchedCode, this->codeSize,
patch_ptr,
kMinSize)) {
size_t _analyze(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t parseShortJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t _analyzeRelocated(PatchList::Patch &patch, BYTE *patch_ptr)
bool is64Modifier(BYTE op)
size_t parseJmpViaAddr(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t parseJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
ULONGLONG getJmpDestAddr(ULONGLONG currVA, int instrLen, DELTA_T lVal)
size_t parseMovJmp(PatchList::Patch &patch, PBYTE patch_ptr, bool is_long)
size_t parsePushRet(PatchList::Patch &patch, PBYTE patch_ptr)
bool isLongModifier(BYTE op)
size_t analyze(PatchList::Patch &patch)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)