Index: lib/interception/interception_win.cc =================================================================== --- lib/interception/interception_win.cc +++ lib/interception/interception_win.cc @@ -124,6 +124,9 @@ case '\xb8': // b8 XX XX XX XX : mov eax, XX XX XX XX cursor += 5; continue; + case '\xEB': // eb XX : jmp +XX (short jump) + cursor += 2; + continue; } switch (*(unsigned short*)(code + cursor)) { // NOLINT @@ -131,6 +134,9 @@ case 0x5340: // 40 53 : rex push rbx cursor += 2; continue; + case 0x25FF: // FF 25 XX XX XX XX : jmp qword ptr + cursor += 6; + continue; } switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) { @@ -168,6 +174,12 @@ continue; } + switch (*(unsigned int*)(code + cursor)) { + case 0x24448b48: // 48 8b 44 24 XX : mov rax, qword ptr [rsp + 0xXX] + cursor += 5; + continue; + } + // Check first 5 bytes. switch (0xFFFFFFFFFFull & *(unsigned long long*)(code + cursor)) { case 0x08245c8948: // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx