diff --git a/src/vmprofiles/svsp.cpp b/src/vmprofiles/svsp.cpp index 7175fcf..bd565d0 100644 --- a/src/vmprofiles/svsp.cpp +++ b/src/vmprofiles/svsp.cpp @@ -31,19 +31,20 @@ profiler_t svsp = { }}}, [](zydis_reg_t& vip, zydis_reg_t& vsp, hndlr_trace_t& hndlr) -> std::optional { - vinstr_t res{mnemonic_t::lvsp}; - const auto sub_vsp = std::find_if( + vinstr_t res{mnemonic_t::svsp}; + const auto mov_vsp_reg = std::find_if( hndlr.m_instrs.begin(), hndlr.m_instrs.end(), [&](emu_instr_t& instr) -> bool { const auto& i = instr.m_instr; - return i.mnemonic == ZYDIS_MNEMONIC_SUB && - i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && - i.operands[0].reg.value == vsp && - i.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE; + return i.mnemonic == ZYDIS_MNEMONIC_MOV && + i.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY && + i.operands[0].mem.base == vsp && + i.operands[0].mem.disp.has_displacement == false && + i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER; }); res.imm.has_imm = false; - res.stack_size = sub_vsp->m_instr.operands[1].imm.value.u; + res.stack_size = mov_vsp_reg->m_instr.operands[1].size; return res; }}; } \ No newline at end of file