Advertisement
Guest User

Untitled

a guest
Sep 30th, 2016
69
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.27 KB | None | 0 0
  1. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  2. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  3. UInt8 * mm_factory_method(UInt32 p_Trampoline, UInt8 p_Length)
  4. {
  5. //!
  6. //! 0xA0 = Epilogue + Prologue
  7. //! 0x03 = Parameter
  8. //! 0x05 = Call
  9. //! 0x03 = Return
  10. //!
  11. auto r_Length = 0x0A + (p_Length * 0x03) + 0x05 + 0x03;
  12. auto r_Index = 0;
  13.  
  14. auto r_Bytes = new uint8_t[r_Length];
  15.  
  16. //!
  17. //! Assembly::Epilogue
  18. //!
  19. r_Bytes[r_Index++] = 0x55;
  20. r_Bytes[r_Index++] = 0x89;
  21. r_Bytes[r_Index++] = 0xE5;
  22. r_Bytes[r_Index++] = 0x60;
  23. r_Bytes[r_Index++] = 0x9C;
  24.  
  25. //!
  26. //! Assembly::Call
  27. //!
  28. for (auto i = 0; i < p_Length; i++)
  29. {
  30. r_Bytes[r_Index++] = 0xFF;
  31. r_Bytes[r_Index++] = 0x75;
  32. r_Bytes[r_Index++] = (p_Length - i) * sizeof(UInt32) + 0x04;
  33. }
  34. r_Bytes[r_Index++] = 0xE8;
  35. *(UInt32 *)(r_Bytes + r_Index) = p_Trampoline;
  36. r_Index += 0x04;
  37.  
  38. //!
  39. //! Assembly::Prologue
  40. //!
  41. r_Bytes[r_Index++] = 0x9D;
  42. r_Bytes[r_Index++] = 0x61;
  43. r_Bytes[r_Index++] = 0x89;
  44. r_Bytes[r_Index++] = 0xEC;
  45. r_Bytes[r_Index++] = 0x5D;
  46.  
  47. //!
  48. //! Assembly::Return
  49. //!
  50. r_Bytes[r_Index++] = 0xC2;
  51. *(UInt16 *)(r_Bytes + r_Index) = p_Length * sizeof(UInt32);
  52.  
  53. return r_Bytes;
  54. }
  55.  
  56. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  57. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
  58. UInt8 * mm_factory_method_jump(UInt32 p_Trampoline, UInt32 p_Original, UInt8 p_Length)
  59. {
  60. //!
  61. //! 0xA0 = Epilogue + Prologue
  62. //! 0x03 = Parameter
  63. //! 0x05 = Call
  64. //! 0x05 = Jump
  65. //!
  66. auto r_Length = 0x0A + (p_Length * 0x03) + 0x05 + 0x05;
  67. auto r_Index = 0;
  68.  
  69. auto r_Bytes = new uint8_t[r_Length];
  70.  
  71. //!
  72. //! Assembly::Epilogue
  73. //!
  74. r_Bytes[r_Index++] = 0x55;
  75. r_Bytes[r_Index++] = 0x89;
  76. r_Bytes[r_Index++] = 0xE5;
  77. r_Bytes[r_Index++] = 0x60;
  78. r_Bytes[r_Index++] = 0x9C;
  79.  
  80. //!
  81. //! Assembly::Call
  82. //!
  83. for (auto i = 0; i < p_Length; i++)
  84. {
  85. r_Bytes[r_Index++] = 0xFF;
  86. r_Bytes[r_Index++] = 0x75;
  87. r_Bytes[r_Index++] = (p_Length - i) * sizeof(UInt32) + 0x04;
  88. }
  89. r_Bytes[r_Index++] = 0xE8;
  90. *(UInt32 *)(r_Bytes + r_Index) = p_Trampoline;
  91. r_Index += 0x04;
  92.  
  93. //!
  94. //! Assembly::Prologue
  95. //!
  96. r_Bytes[r_Index++] = 0x9D;
  97. r_Bytes[r_Index++] = 0x61;
  98. r_Bytes[r_Index++] = 0x89;
  99. r_Bytes[r_Index++] = 0xEC;
  100. r_Bytes[r_Index++] = 0x5D;
  101.  
  102. //!
  103. //! Assembly::Return
  104. //!
  105. r_Bytes[r_Index++] = 0xE9;
  106. *(UInt32 *)(r_Bytes + r_Index) = p_Original;
  107. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement