General Chinese Topics

inline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)
 
{
 
  if (pbCode == NULL) {
 
    return NULL;
 
  }
 
  if (ppGlobals != NULL) {
 
    *ppGlobals = NULL;
 
  }
 
  if (pbCode[0] == 0xff && pbCode[1] == 0x25) {   // jmp [+imm32]

    // Looks like an import alias jump, then get the code it points to.

    // on x64 we have a 32-bit offset...

    PBYTE pbTarget = *(PBYTE*)(pbCode + 6 + *(INT32 *)&pbCode[2]);
 
    if (detour_is_imported(pbCode, pbTarget)) {
 
      PBYTE pbNew = *(PBYTE *)pbTarget;
 
      DETOUR_TRACE(("%p->%p: skipped over import table./n", pbCode, pbNew));
 

      return pbNew;
 
    }
 
    return detour_skip_jmp(pbTarget, ppGlobals);
 
  }
 
  else if (pbCode[0] == 0xe9) {   // jmp + rel32, Near jump with the target

    /*
 
    SEH64!ILT+15(?CallThatFunctionYAHXZ):
 
    00000000`00401014 e957000000      jmp     SEH64!CallThatFunction (000000
00`00401070)
 
    SEH64!CallThatFunction [d:/study/win64/seh64/seh64.cpp @ 11]:
 
    00000000`00401070 4057            push    rdi
 
    00000000`00401072 4883ec40        sub     rsp,40h
 
    00000000`00401076 488bfc          mov     rdi,rsp
 
    */
 
    PBYTE pbNew = pbCode + 5 + *(INT32 *)&pbCode[1];
 
    return detour_skip_jmp(pbNew, ppGlobals);
 
  }
 
  else if (pbCode[0] == 0xeb) {   // jmp +imm8

    // These just started appearing with CL13.

    PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];
 
    return detour_skip_jmp(pbNew, ppGlobals);
 
  }
 
  return pbCode;
 
}

#ifdef DETOURS_X64 // For Rex Prefix
    { 0x40, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x41, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x42, ENTRY_CopyBytesPrefix },                    // REX Prefixes

    { 0x43, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x44, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x45, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x46, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x47, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x48, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x49, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x4A, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x4B, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x4C, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x4D, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x4E, ENTRY_CopyBytesPrefix },                    // REX Prefixes
    { 0x4F, ENTRY_CopyBytesPrefix },                    // REX Prefixes
#else

far indirect jmp/call

PBYTE CDetourDis::CopyFF(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
 
{   // CALL /2

    // CALL /3

    // INC /0

    // JMP /4

    // JMP /5

    // PUSH /6

    (void)pEntry;
 
    if (0x15 == pbSrc[1] || 0x25 == pbSrc[1]) {         // CALL [], JMP []

#ifdef DETOURS_X64

        DWORD dwOffset = *((PDWORD)&pbSrc[2]);
 
        *m_ppbTarget = (PBYTE)*((PDWORD_PTR)(pbSrc + 6 + dwOffset));
 
#else

        PBYTE *ppbTarget = *(PBYTE**)&pbSrc[2];
 
        *m_ppbTarget = *ppbTarget;
 
#endif

    }
 
    else if (0x10 == (0x38 & pbSrc[1]) || // CALL /2 --> reg(bits 543) of Mo
dR/M == 010
 
             0x18 == (0x38 & pbSrc[1]) || // CALL /3 --> reg(bits 543) of Mo
dR/M == 011
 
             0x20 == (0x38 & pbSrc[1]) || // JMP /4 --> reg(bits 543) of Mod
R/M == 100
 
             0x28 == (0x38 & pbSrc[1])    // JMP /5 --> reg(bits 543) of Mod
R/M == 101
 
            ) {
 
        *m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
 
    }
 
    const COPYENTRY ce = { 0xff, ENTRY_CopyBytes2Mod };
 
    return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);
 
}

inline PBYTE detour_gen_jmp(PBYTE pbCode, PBYTE pbJumpTo)
 
{
 
  PBYTE pbJumpFrom = pbCode + 5;
 
  SIZE_T cbDiff = pbJumpFrom > pbJumpTo ? pbJumpFrom - pbJumpTo : pbJumpTo -
 pbJumpFrom;
 
  if (cbDiff <= 0x7fff0000) {
 
    *pbCode++ = 0xe9;
 
    *((PDWORD)pbCode) = (DWORD)(DWORD_PTR)(pbJumpTo - pbJumpFrom);
 
    pbCode += sizeof(DWORD);
 
  } else {
 
    *pbCode++ = 0xff;
 
    *pbCode++ = 0x25;
 
    // on x64 we write the relative address of the same location

    *((PDWORD)pbCode) = (DWORD)0;
 
    pbCode += sizeof(DWORD);
 
    
 
    *((PDWORD_PTR)pbCode) = (DWORD_PTR)(pbJumpTo);
 
    pbCode += sizeof(DWORD_PTR);
 
  }
 
  return pbCode;
 
}

#ifdef DETOURS_X64

#define DETOURS_EIP         Rip
#define DETOURS_EIP_TYPE    DWORD64

#endif // DETOURS_X64