comments

misc.c

@@ -1,15 +1,43 @@
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+
+#ifdef WINDOWS
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+
 #include "udis86.h"
 #include "misc.h"
 
+void* alloc_rwx(size_t size) {
+#ifdef WINDOWS
+	return VirtualAlloc(NULL, size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWIRTE);
+#else
+	return mmap(NULL, size, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+#endif
+}
+
+bool set_rwx(void* addr, size_t size) {
+#ifdef WINDOWS
+	DWORD tmp;
+	return VirtualProtect(addr, size, PAGE_EXECUTE_READWIRTE, &tmp) == TRUE;
+#else
+	return mprotect(addr, size, PROT_READ | PROT_WRITE | PROT_EXEC) == 0;
+#endif
+}
+
 void disassemble_func(void* function, size_t numberOfInstr)
 {
 	unsigned char* p = function;
 	ud_t ud;
 
 	ud_init(&ud);
-	ud_set_input_buffer(&ud, function, (size_t)function | (0x1000 - 1)); // Can't read further than page boundary - there be dragons
+	ud_set_input_buffer(&ud, function,
+						(size_t)function | (0x1000 - 1) // Can't read further than page boundary - there be dragons
+		);
 	ud_set_pc(&ud, (uint64_t)function);
 	ud_set_mode(&ud, 64);
 	ud_set_syntax(&ud, UD_SYN_INTEL);
@@ -24,8 +52,15 @@ void disassemble_func(void* function, size_t numberOfInstr)
 
 		printf("%p %s\n", ud_insn_off(&ud), ud_insn_asm(&ud));
 
-		// ugly, ugly hack todo: make it work
+		/* jmp qword [rip] is used by the hooking engine
+		 * x64 relative jumps don't exists so this way is used:
+		 * 	jmp qword [rip]
+		 * 	address where to tjump to
+		 * 	other code
+		 * Disassembling the address fucks up the dissassembling
+		 * todo: Follow all jump targets?
+		 */
 		if(strcmp(ud_insn_asm(&ud), "jmp qword [rip]") == 0)
 			p += 8;
 	}
-}
+}