Cxbx-Reloaded/subhook
1
0
Fork 0
mirror of https://github.com/Cxbx-Reloaded/subhook.git synced 2024-12-02 16:20:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add support for for XOR, ADD, AND, OR, ENTER, LEAVE, INT 3

Browse Source
This commit is contained in:
Zeex 2018-11-04 22:25:44 +06:00
parent 92f93d47dc
commit e0b2b68495
1 changed files with 48 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
subhook_x86.c
View File

@ -116,11 +116,32 @@ static size_t subhook_disasm(void *src, int32_t *reloc_op_offset) {
* https://www-ssl.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html
*/
static struct opcode_info opcodes[] = {
/* ADD AL, imm8 */ {0x04, 0, IMM8},
/* ADD EAX, imm32 */ {0x05, 0, IMM32},
/* ADD r/m8, imm8 */ {0x80, 0, MODRM | REG_OPCODE | IMM8},
/* ADD r/m32, imm32 */ {0x81, 0, MODRM | REG_OPCODE | IMM32},
/* ADD r/m32, imm8 */ {0x83, 0, MODRM | REG_OPCODE | IMM8},
/* ADD r/m8, r8 */ {0x00, 0, MODRM},
/* ADD r/m32, r32 */ {0x01, 0, MODRM},
/* ADD r8, r/m8 */ {0x02, 0, MODRM},
/* ADD r32, r/m32 */ {0x03, 0, MODRM},
/* AND AL, imm8 */ {0x24, 0, IMM8},
/* AND EAX, imm32 */ {0x25, 0, IMM32},
/* AND r/m8, imm8 */ {0x80, 4, MODRM | REG_OPCODE | IMM8},
/* AND r/m32, imm32 */ {0x81, 4, MODRM | REG_OPCODE | IMM32},
/* AND r/m32, imm8 */ {0x83, 4, MODRM | REG_OPCODE | IMM8},
/* AND r/m8, r8 */ {0x20, 0, MODRM},
/* AND r/m32, r32 */ {0x21, 0, MODRM},
/* AND r8, r/m8 */ {0x22, 0, MODRM},
/* AND r32, r/m32 */ {0x23, 0, MODRM},
/* CALL rel32 */ {0xE8, 0, IMM32 | RELOC},
/* CALL r/m32 */ {0xFF, 2, MODRM | REG_OPCODE},
/* ENTER imm16, imm8 */ {0xC8, 0, IMM16 | IMM8},
/* INT 3 */ {0xCC, 0, 0},
/* JMP rel32 */ {0xE9, 0, IMM32 | RELOC},
/* JMP r/m32 */ {0xFF, 4, MODRM | REG_OPCODE},
/* LEA r32,m */ {0x8D, 0, MODRM},
/* LEAVE */ {0xC9, 0, 0},
/* MOV r/m8,r8 */ {0x88, 0, MODRM},
/* MOV r/m32,r32 */ {0x89, 0, MODRM},
/* MOV r8,r/m8 */ {0x8A, 0, MODRM},
@ -135,6 +156,16 @@ static size_t subhook_disasm(void *src, int32_t *reloc_op_offset) {
/* MOV r32, imm32 */ {0xB8, 0, PLUS_R | IMM32},
/* MOV r/m8, imm8 */ {0xC6, 0, MODRM | REG_OPCODE | IMM8},
/* MOV r/m32, imm32 */ {0xC7, 0, MODRM | REG_OPCODE | IMM32},
/* NOP */ {0x90, 0, 0},
/* OR AL, imm8 */ {0x0C, 0, IMM8},
/* OR EAX, imm32 */ {0x0D, 0, IMM32},
/* OR r/m8, imm8 */ {0x80, 1, MODRM | REG_OPCODE | IMM8},
/* OR r/m32, imm32 */ {0x81, 1, MODRM | REG_OPCODE | IMM32},
/* OR r/m32, imm8 */ {0x83, 1, MODRM | REG_OPCODE | IMM8},
/* OR r/m8, r8 */ {0x08, 0, MODRM},
/* OR r/m32, r32 */ {0x09, 0, MODRM},
/* OR r8, r/m8 */ {0x0A, 0, MODRM},
/* OR r32, r/m32 */ {0x0B, 0, MODRM},
/* POP r/m32 */ {0x8F, 0, MODRM | REG_OPCODE},
/* POP r32 */ {0x58, 0, PLUS_R},
/* PUSH r/m32 */ {0xFF, 6, MODRM | REG_OPCODE},
@ -148,7 +179,9 @@ static size_t subhook_disasm(void *src, int32_t *reloc_op_offset) {
/* SUB r/m8, imm8 */ {0x80, 5, MODRM | REG_OPCODE | IMM8},
/* SUB r/m32, imm32 */ {0x81, 5, MODRM | REG_OPCODE | IMM32},
/* SUB r/m32, imm8 */ {0x83, 5, MODRM | REG_OPCODE | IMM8},
/* SUB r/m8, r8 */ {0x28, 0, MODRM},
/* SUB r/m32, r32 */ {0x29, 0, MODRM},
/* SUB r8, r/m8 */ {0x2A, 0, MODRM},
/* SUB r32, r/m32 */ {0x2B, 0, MODRM},
/* TEST AL, imm8 */ {0xA8, 0, IMM8},
/* TEST EAX, imm32 */ {0xA9, 0, IMM32},
@ -156,7 +189,15 @@ static size_t subhook_disasm(void *src, int32_t *reloc_op_offset) {
/* TEST r/m32, imm32 */ {0xF7, 0, MODRM | REG_OPCODE | IMM32},
/* TEST r/m8, r8 */ {0x84, 0, MODRM},
/* TEST r/m32, r32 */ {0x85, 0, MODRM},
/* NOP */ {0x90, 0, 0}
/* XOR AL, imm8 */ {0x34, 0, IMM8},
/* XOR EAX, imm32 */ {0x35, 0, IMM32},
/* XOR r/m8, imm8 */ {0x80, 6, MODRM | REG_OPCODE | IMM8},
/* XOR r/m32, imm32 */ {0x81, 6, MODRM | REG_OPCODE | IMM32},
/* XOR r/m32, imm8 */ {0x83, 6, MODRM | REG_OPCODE | IMM8},
/* XOR r/m8, r8 */ {0x30, 0, MODRM},
/* XOR r/m32, r32 */ {0x31, 0, MODRM},
/* XOR r8, r/m8 */ {0x32, 0, MODRM},
/* XOR r32, r/m32 */ {0x33, 0, MODRM}
};
uint8_t *code = src;
@ -164,6 +205,7 @@ static size_t subhook_disasm(void *src, int32_t *reloc_op_offset) {
size_t len = 0;
size_t operand_size = 4;
uint8_t opcode = 0;
int found_opcode = false;
for (i = 0; i < sizeof(prefixes) / sizeof(*prefixes); i++) {
if (code[len] == prefixes[i]) {
@ -189,28 +231,26 @@ static size_t subhook_disasm(void *src, int32_t *reloc_op_offset) {
#endif
for (i = 0; i < sizeof(opcodes) / sizeof(*opcodes); i++) {
int found = false;
if (code[len] == opcodes[i].opcode) {
if (opcodes[i].flags & REG_OPCODE) {
found = ((code[len + 1] >> 3) & 7) == opcodes[i].reg_opcode;
found_opcode = ((code[len + 1] >> 3) & 7) == opcodes[i].reg_opcode;
} else {
found = true;
found_opcode = true;
}
}
if ((opcodes[i].flags & PLUS_R)
&& (code[len] & 0xF8) == opcodes[i].opcode) {
found = true;
found_opcode = true;
}
if (found) {
if (found_opcode) {
opcode = code[len++];
break;
}
}
if (opcode == 0) {
if (!found_opcode) {
return 0;
}