This is an archive of the discontinued LLVM Phabricator instance.

[winasan] Update GetInstructionSize for Win10 1803
ClosedPublic

Authored by dmajor on May 4 2018, 1:47 PM.

Reviewers

Commits

Summary

In Windows version 1803, the first instruction of ntdll!strchr is:
8a01 mov al,byte ptr [rcx]

This is the only needed change for this version as far as I can tell.

lgtm

This revision is now accepted and ready to land.May 8 2018, 10:37 AM

This revision was automatically updated to reflect the committed changes.

Path

Size

lib/

interception/

	interception_win.cc
	interception_win.cc (revision 331068)

1 line

Show First 20 Lines • Show All 447 Lines • ▼ Show 20 Lines	switch ((u8)address) {
case 0x7C:		case 0x7C:
case 0x7D:		case 0x7D:
case 0x7E:		case 0x7E:
case 0x7F:		case 0x7F:
return 0;		return 0;
}		}

switch ((u16)(address)) {		switch ((u16)(address)) {
		case 0x018A: // 8A 01 : mov al, byte ptr [ecx]
case 0xFF8B: // 8B FF : mov edi, edi		case 0xFF8B: // 8B FF : mov edi, edi
case 0xEC8B: // 8B EC : mov ebp, esp		case 0xEC8B: // 8B EC : mov ebp, esp
case 0xc889: // 89 C8 : mov eax, ecx		case 0xc889: // 89 C8 : mov eax, ecx
case 0xC18B: // 8B C1 : mov eax, ecx		case 0xC18B: // 8B C1 : mov eax, ecx
case 0xC033: // 33 C0 : xor eax, eax		case 0xC033: // 33 C0 : xor eax, eax
case 0xC933: // 33 C9 : xor ecx, ecx		case 0xC933: // 33 C9 : xor ecx, ecx
case 0xD233: // 33 D2 : xor edx, edx		case 0xD233: // 33 D2 : xor edx, edx
return 2;		return 2;
▲ Show 20 Lines • Show All 553 Lines • Show Last 20 Lines