enum _MACHINE_CODE{
OPCODE_EB = 0xEB,
OPCODE_PUSH = 0x68,
OPCODE_CALL = 0xE8,
OPCODE_JMP = 0xE9,
OPCODE_JO = 0x70,
OPCODE_JNO,
OPCODE_JB,
OPCODE_JNB,
OPCODE_JE,
OPCODE_JNZ,
OPCODE_JBE,
OPCODE_JA,
OPCODE_JS,
OPCODE_JNS,
OPCODE_JPE,
OPCODE_JPO,
OPCODE_JL,
OPCODE_JGE,
OPCODE_JLE,
OPCODE_JG,
OPCODE_JO_LONG = 0x800F ,
OPCODE_JNO_LONG = 0x810F ,
OPCODE_JB_LONG = 0x820F ,
OPCODE_JNB_LONG = 0x830F ,
OPCODE_JE_LONG = 0x840F ,
OPCODE_JNZ_LONG = 0x850F ,
OPCODE_JBE_LONG = 0x860F ,
OPCODE_JA_LONG = 0x870F ,
OPCODE_JS_LONG = 0x880F ,
OPCODE_JNS_LONG = 0x890F ,
OPCODE_JPE_LONG = 0x8A0F ,
OPCODE_JPO_LONG = 0x8B0F ,
OPCODE_JL_LONG = 0x8C0F ,
OPCODE_JGE_LONG = 0x8D0F ,
OPCODE_JLE_LONG = 0x8E0F ,
OPCODE_JG_LONG = 0x8F0F
};
case OPCODE_JO: \
case OPCODE_JNO: \
case OPCODE_JB: \
case OPCODE_JNB: \
case OPCODE_JE: \
case OPCODE_JNZ: \
case OPCODE_JBE: \
case OPCODE_JA: \
case OPCODE_JS: \
case OPCODE_JNS: \
case OPCODE_JPE: \
case OPCODE_JPO: \
case OPCODE_JL: \
case OPCODE_JGE: \
case OPCODE_JLE: \
case OPCODE_JG:
ULONG GetProcSize(PUCHAR Opcode){
ULONG iOffSet = 0;
ULONG iOpcodeOfSize = 0;
ULONG iStart = (ULONG)Opcode;
LONG addr ;
PSHORT_JUMP_ADDR_LIST ListHead = NULL;
PSHORT_JUMP_ADDR_LIST pCurrent = NULL;
BOOL bNext = TRUE;
InitializeList ( ListHead ,pCurrent,SHORT_JUMP_ADDR_LIST ) ;
do
{
addr = 0;
iOpcodeOfSize = GetOpCodeSize( Opcode + iOffSet );
switch( *(BYTE*)( Opcode + iOffSet ) ){
CASESHORTADDR; {
if ( iOpcodeOfSize != 2 )
break;
addr = GetShortAddr( (LONG)Opcode + iOffSet ) ;
if ( iStart > addr ) // 说明这个跳转超出了函数头,直接不管
break;
// 重复的不记录
if ( FindDuplicate( ListHead, addr ) )
break;
PSHORT_JUMP_ADDR_LIST p = (PSHORT_JUMP_ADDR_LIST)malloc( sizeof(SHORT_JUMP_ADDR_LIST) );
if ( !p ){
iOffSet = 0;
goto eXit0;
}
p->pos = addr ;
InsertList( p,pCurrent );
__DEBUG(DebugPrint("[*] Short Address:0x%08x\r\n" , p->pos ));
}
break;
case 0xC3:
case 0xC2: {
// 在链表中查找这个地址是否大于所有跳转,如果是,说明函数结束
if ( DetectedEnd( ListHead, (LONG)Opcode + iOffSet ) ){
bNext = FALSE;
__DEBUG(DebugPrint("[*] End address:0x%08X\r\n" ,(LONG)Opcode + iOffSet ));
}
}
break;
}
iOffSet += iOpcodeOfSize ;
}
while ( bNext );
eXit0:
ReleaseListResource( ListHead );
return iOffSet;
}
弱弱的回下，这个局限比较大呀,不是我理想的
