correct opcode checking, same logic as in original
This commit is contained in:
@@ -16,6 +16,9 @@
|
||||
#define METHOD_FLAG_CALLTRICK_1 0x40
|
||||
#define METHOD_FLAG_CALLTRICK_2 0x80
|
||||
|
||||
#define OP_CALL_REL32 0xE8
|
||||
#define OP_JMP_REL32 0xE9
|
||||
|
||||
static const char* str_usage = "Usage: %s [--nologo / -n] [--kernel / -k] [--unpack / -u] <infile> [<outfile>]\n";
|
||||
|
||||
static void error_load_infile() {
|
||||
@@ -60,10 +63,7 @@ unsigned preprocess_calltrick(unsigned char *infile, unsigned insize, unsigned c
|
||||
do {
|
||||
//printf("infile_ptr = %p, count = %u\n", infile_ptr, count);
|
||||
unsigned opcode = *(infile_ptr++);
|
||||
// E8 dword: call rel32
|
||||
// E9 dword: jmp rel32
|
||||
if (opcode > 0xE9)
|
||||
{
|
||||
if (opcode != OP_CALL_REL32 && opcode != OP_JMP_REL32) {
|
||||
continue;
|
||||
}
|
||||
if (count < 5) {
|
||||
|
Reference in New Issue
Block a user