Bug 1240848: Adds additional instructions to x64 detour patcher; r=ehsan

This commit is contained in:
Aaron Klotz 2016-01-19 15:14:24 -07:00
parent c8f694bf43
commit b5cff69632
2 changed files with 31 additions and 0 deletions

View File

@ -162,6 +162,9 @@ int main()
TestHook("imm32.dll", "ImmGetContext") &&
TestHook("imm32.dll", "ImmGetCompositionStringW") &&
TestHook("imm32.dll", "ImmSetCandidateWindow") &&
#ifdef _M_X64
TestHook("user32.dll", "CreateWindowExW") &&
#endif
TestDetour("ntdll.dll", "LdrLoadDll")) {
printf("TEST-PASS | WindowsDllInterceptor | all checks passed\n");
return 0;

View File

@ -738,6 +738,31 @@ protected:
// not support yet!
return;
}
} else if (origBytes[nBytes] == 0x66) {
// operand override prefix
nBytes += 1;
// This is the same as the x86 version
if (origBytes[nBytes] >= 0x88 && origBytes[nBytes] <= 0x8B) {
// various MOVs
unsigned char b = origBytes[nBytes + 1];
if (((b & 0xc0) == 0xc0) ||
(((b & 0xc0) == 0x00) &&
((b & 0x07) != 0x04) && ((b & 0x07) != 0x05))) {
// REG=r, R/M=r or REG=r, R/M=[r]
nBytes += 2;
} else if ((b & 0xc0) == 0x40) {
if ((b & 0x07) == 0x04) {
// REG=r, R/M=[SIB + disp8]
nBytes += 4;
} else {
// REG=r, R/M=[r + disp8]
nBytes += 3;
}
} else {
// complex MOV, bail
return;
}
}
} else if ((origBytes[nBytes] & 0xf0) == 0x50) {
// 1-byte push/pop
nBytes++;
@ -747,6 +772,9 @@ protected:
} else if (origBytes[nBytes] == 0xb8) {
// MOV 0xB8: http://ref.x86asm.net/coder32.html#xB8
nBytes += 5;
} else if (origBytes[nBytes] == 0x33) {
// xor r32, r/m32
nBytes += 2;
} else if (origBytes[nBytes] == 0xc3) {
// ret
nBytes++;