Index: lib/interception/interception_win.cc =================================================================== --- lib/interception/interception_win.cc +++ lib/interception/interception_win.cc @@ -129,14 +129,14 @@ continue; } - switch (*(unsigned short*)(code + cursor)) { // NOLINT + switch (*(u16*)(code + cursor)) { // NOLINT case 0x5540: // 40 55 : rex push rbp case 0x5340: // 40 53 : rex push rbx cursor += 2; continue; } - switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) { + switch (0x00FFFFFF & *(u32*)(code + cursor)) { case 0xc18b48: // 48 8b c1 : mov rax, rcx case 0xc48b48: // 48 8b c4 : mov rax, rsp case 0xd9f748: // 48 f7 d9 : neg rcx @@ -171,14 +171,14 @@ continue; } - switch (*(unsigned int*)(code + cursor)) { + switch (*(u32*)(code + cursor)) { case 0x24448b48: // 48 8b 44 24 XX : mov rax, qword ptr [rsp + 0xXX] cursor += 5; continue; } // Check first 5 bytes. - switch (0xFFFFFFFFFFull & *(unsigned long long*)(code + cursor)) { + switch (0xFFFFFFFFFFull & *(u64*)(code + cursor)) { case 0x08245c8948: // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx case 0x1024748948: // 48 89 74 24 10 : mov QWORD PTR [rsp+0x10], rsi cursor += 5; @@ -186,7 +186,7 @@ } // Check 8 bytes. - switch (*(unsigned long long*)(code + cursor)) { + switch (*(u64*)(code + cursor)) { case 0x90909090909006EBull: // JMP +6, 6x NOP cursor += 8; continue; @@ -201,6 +201,28 @@ size_t cursor = 0; while (cursor < size) { switch (code[cursor]) { + case '\xE8': // E8 XX XX XX XX = call + case '\xE9': // E9 XX XX XX XX = jmp