mirror of
https://github.com/hasherezade/pe-sieve
synced 2026-06-08 14:34:52 +00:00
hasherezade
81 lines
2.1 KiB
C++
81 lines
2.1 KiB
C++
#pragma once
|
|
#include <windows.h>
|
|
|
|
namespace pesieve {
|
|
|
|
typedef struct _t_pattern {
|
|
BYTE* ptr;
|
|
size_t size;
|
|
} t_pattern;
|
|
|
|
BYTE prolog32_pattern[] = {
|
|
0x55, // PUSH EBP
|
|
0x8b, 0xEC // MOV EBP, ESP
|
|
};
|
|
|
|
BYTE prolog32_2_pattern[] = {
|
|
0x55, // PUSH EBP
|
|
0x89, 0xE5 // MOV EBP, ESP
|
|
};
|
|
|
|
BYTE prolog32_3_pattern[] = {
|
|
0x60, // PUSHAD
|
|
0x89, 0xE5 // MOV EBP, ESP
|
|
};
|
|
|
|
t_pattern patterns32[] = {
|
|
{ prolog32_pattern, sizeof(prolog32_pattern) },
|
|
{ prolog32_2_pattern, sizeof(prolog32_2_pattern) },
|
|
{ prolog32_3_pattern, sizeof(prolog32_3_pattern) }
|
|
};
|
|
|
|
BYTE prolog64_pattern[] = {
|
|
0x40, 0x53, // PUSH RBX
|
|
0x48, 0x83, 0xEC // SUB RSP, <BYTE>
|
|
};
|
|
BYTE prolog64_2_pattern[] = {
|
|
0x55, // PUSH RBP
|
|
0x48, 0x8B, 0xEC // MOV RBP, RSP
|
|
};
|
|
BYTE prolog64_3_pattern[] = {
|
|
0x40, 0x55, // PUSH RBP
|
|
0x48, 0x83, 0xEC // SUB RSP, <BYTE>
|
|
};
|
|
BYTE prolog64_4_pattern[] = {
|
|
0x53, // PUSH RBX
|
|
0x48, 0x81, 0xEC // SUB RSP, <DWORD>
|
|
};
|
|
BYTE prolog64_5_pattern[] = {
|
|
0x48, 0x83, 0xE4, 0xF0 // AND rsp, FFFFFFFFFFFFFFF0; Align RSP to 16 bytes
|
|
};
|
|
BYTE prolog64_6_pattern[] = {
|
|
0x57, // PUSH RDI
|
|
0x48, 0x89, 0xE7 // MOV RDI, RSP
|
|
};
|
|
BYTE prolog64_7_pattern[] = {
|
|
0x48, 0x8B, 0xC4, // MOV RAX, RSP
|
|
0x48, 0x89, 0x58, 0x08, // MOV QWORD PTR [RAX + 8], RBX
|
|
0x4C, 0x89, 0x48, 0x20, // MOV QWORD PTR [RAX + 0X20], R9
|
|
0x4C, 0x89, 0x40, 0x18, // MOV QWORD PTR [RAX + 0X18], R8
|
|
0x48, 0x89, 0x50, 0x10, // MOV QWORD PTR [RAX + 0X10], RDX
|
|
0x55, // PUSH RBP
|
|
0x56, // PUSH RSI
|
|
0x57, // PUSH RDI
|
|
0x41, 0x54, // PUSH R12
|
|
0x41, 0x55, // PUSH R13
|
|
0x41, 0x56, // PUSH R14
|
|
0x41, 0x57 // PUSH R15
|
|
};
|
|
|
|
t_pattern patterns64[] = {
|
|
{ prolog64_pattern, sizeof(prolog64_pattern) },
|
|
{ prolog64_2_pattern, sizeof(prolog64_2_pattern) },
|
|
{ prolog64_3_pattern, sizeof(prolog64_3_pattern) },
|
|
{ prolog64_4_pattern, sizeof(prolog64_4_pattern) },
|
|
{ prolog64_5_pattern, sizeof(prolog64_5_pattern) },
|
|
{ prolog64_6_pattern, sizeof(prolog64_6_pattern) },
|
|
{ prolog64_7_pattern, sizeof(prolog64_7_pattern) }
|
|
};
|
|
|
|
}; // namespace pesieve
|