fixed an issue in LRFLAGS profile

4 years ago · 231388d6fc
parent c932e71cdd
commit 231388d6fc
1 changed files with 3 additions and 1 deletions
--- a/src/vmprofiles/lflags.cpp
+++ b/src/vmprofiles/lflags.cpp
@ -23,7 +23,9 @@ namespace vm
                    []( const zydis_decoded_instr_t &instr ) -> bool {
                        return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                               instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP;
+                               instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
+                               instr.operands[ 1 ].imm.value.u == 0x8;
                    },
                    // POPFQ
                    []( const zydis_decoded_instr_t &instr ) -> bool {