yizhi-js-lib/favicon-trap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x86: support hooking SYSCALL/SYSENTER instructions. we no longer share the SYSCALL callback with interrupt instructions

Browse Source
This commit is contained in:
Nguyen Anh Quynh
2015-08-23 01:19:40 +08:00
parent 3eeda8c8eb
commit e1baf2f36b
7 changed files with 41 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
uc.c
View File

@ -645,6 +645,18 @@ static uc_err _hook_insn(struct uc_struct *uc, unsigned int insn_id, void *callb
return UC_ERR_OK;
} else
return UC_ERR_OOM;
case X86_INS_SYSCALL:
case X86_INS_SYSENTER:
// FIXME: only one event handler at the same time
i = hook_find_new(uc);
if (i) {
uc->hook_callbacks[i].callback = callback;
uc->hook_callbacks[i].user_data = user_data;
*evh = i;
uc->hook_syscall_idx = i;
return UC_ERR_OK;
} else
return UC_ERR_OOM;
}
break;
}