[PATCH] Add support for intercepting thunks of the form `jmp dword ptr ds:[WWZZYYXX]`

Ehsan Akhgari ehsan.akhgari at gmail.com
Sat Jul 5 08:10:16 PDT 2014


http://reviews.llvm.org/D4397

Files:
  lib/interception/interception_win.cc

Index: lib/interception/interception_win.cc
===================================================================
--- lib/interception/interception_win.cc
+++ lib/interception/interception_win.cc
@@ -113,6 +113,7 @@
         cursor += 3;
         continue;
       case 0xC1F7:  // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
+      case 0x25FF:  // FF 25 XX YY ZZ WW = jmp dword ptr ds:[WWZZYYXX]
         cursor += 6;
         continue;
       case 0x3D83:  // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D4397.11099.patch
Type: text/x-patch
Size: 495 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20140705/50682cd2/attachment.bin>


More information about the llvm-commits mailing list