ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ntdll: Properly follow jumps when checking a function epilog.

This commit is contained in:
Alexandre Julliard 2012-03-15 20:29:23 +01:00
parent 9ee4809dc3
commit c0610daf77
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
dlls/ntdll/signal_x86_64.c
View File

@ -2629,8 +2629,6 @@ static BOOL is_inside_epilog( BYTE *pc, ULONG64 base, const RUNTIME_FUNCTION *fu
for (;;)
{
DWORD offset;
if ((*pc & 0xf0) == 0x40) pc++; /* rex prefix */
switch (*pc)
@ -2649,11 +2647,15 @@ static BOOL is_inside_epilog( BYTE *pc, ULONG64 base, const RUNTIME_FUNCTION *fu
case 0xc3: /* ret */
return TRUE;
case 0xe9: /* jmp nnnn */
offset = pc + 5 + *(LONG *)(pc + 1) - (BYTE *)base;
return (offset >= function->BeginAddress && offset < function->EndAddress);
pc += 5 + *(LONG *)(pc + 1);
if (pc - (BYTE *)base >= function->BeginAddress && pc - (BYTE *)base < function->EndAddress)
continue;
break;
case 0xeb: /* jmp n */
offset = pc + 2 + (signed char)pc[1] - (BYTE *)base;
return (offset >= function->BeginAddress && offset < function->EndAddress);
pc += 2 + (signed char)pc[1];
if (pc - (BYTE *)base >= function->BeginAddress && pc - (BYTE *)base < function->EndAddress)
continue;
break;
case 0xf3: /* rep; ret (for amd64 prediction bug) */
return pc[1] == 0xc3;
}