From e62c872fbe208e27b43f393daa2eed2a2a1134f8 Mon Sep 17 00:00:00 2001 From: xtremegamer1 Date: Sun, 4 Dec 2022 08:08:45 -0700 Subject: [PATCH] fixed svsp.cpp --- src/vmprofiles/svsp.cpp | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/vmprofiles/svsp.cpp b/src/vmprofiles/svsp.cpp index 7175fcf..bd565d0 100644 --- a/src/vmprofiles/svsp.cpp +++ b/src/vmprofiles/svsp.cpp @@ -31,19 +31,20 @@ profiler_t svsp = { }}}, [](zydis_reg_t& vip, zydis_reg_t& vsp, hndlr_trace_t& hndlr) -> std::optional { - vinstr_t res{mnemonic_t::lvsp}; - const auto sub_vsp = std::find_if( + vinstr_t res{mnemonic_t::svsp}; + const auto mov_vsp_reg = std::find_if( hndlr.m_instrs.begin(), hndlr.m_instrs.end(), [&](emu_instr_t& instr) -> bool { const auto& i = instr.m_instr; - return i.mnemonic == ZYDIS_MNEMONIC_SUB && - i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && - i.operands[0].reg.value == vsp && - i.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE; + return i.mnemonic == ZYDIS_MNEMONIC_MOV && + i.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY && + i.operands[0].mem.base == vsp && + i.operands[0].mem.disp.has_displacement == false && + i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER; }); res.imm.has_imm = false; - res.stack_size = sub_vsp->m_instr.operands[1].imm.value.u; + res.stack_size = mov_vsp_reg->m_instr.operands[1].size; return res; }}; } \ No newline at end of file