From 6ad75d6b390effb080465dfc4cd7c58b761905df Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Tue, 23 Nov 2021 05:57:49 -0800 Subject: [PATCH] this shit bussin no doubt --- src/vmutils.cpp | 39 ++++++--------------------------------- 1 file changed, 6 insertions(+), 33 deletions(-) diff --git a/src/vmutils.cpp b/src/vmutils.cpp index 446f7c0..b9be0e5 100644 --- a/src/vmutils.cpp +++ b/src/vmutils.cpp @@ -81,35 +81,7 @@ namespace vm::util bool is_jmp( const zydis_decoded_instr_t &instr ) { - switch ( instr.mnemonic ) - { - case ZYDIS_MNEMONIC_JB: - case ZYDIS_MNEMONIC_JBE: - case ZYDIS_MNEMONIC_JCXZ: - case ZYDIS_MNEMONIC_JECXZ: - case ZYDIS_MNEMONIC_JKNZD: - case ZYDIS_MNEMONIC_JKZD: - case ZYDIS_MNEMONIC_JL: - case ZYDIS_MNEMONIC_JLE: - case ZYDIS_MNEMONIC_JMP: - case ZYDIS_MNEMONIC_JNB: - case ZYDIS_MNEMONIC_JNBE: - case ZYDIS_MNEMONIC_JNL: - case ZYDIS_MNEMONIC_JNLE: - case ZYDIS_MNEMONIC_JNO: - case ZYDIS_MNEMONIC_JNP: - case ZYDIS_MNEMONIC_JNS: - case ZYDIS_MNEMONIC_JNZ: - case ZYDIS_MNEMONIC_JO: - case ZYDIS_MNEMONIC_JP: - case ZYDIS_MNEMONIC_JRCXZ: - case ZYDIS_MNEMONIC_JS: - case ZYDIS_MNEMONIC_JZ: - return true; - default: - break; - } - return false; + return instr.mnemonic >= ZYDIS_MNEMONIC_JB && instr.mnemonic <= ZYDIS_MNEMONIC_JZ; } bool flatten( zydis_routine_t &routine, std::uintptr_t routine_addr, bool keep_jmps ) @@ -213,10 +185,11 @@ namespace vm::util itr->instr.mnemonic == ZYDIS_MNEMONIC_CALL ) continue; - // lol... we are only looking at linear code anyways... :P - if ( itr->instr.mnemonic == ZYDIS_MNEMONIC_CLC || itr->instr.mnemonic == ZYDIS_MNEMONIC_BT || - itr->instr.mnemonic == ZYDIS_MNEMONIC_TEST || itr->instr.mnemonic == ZYDIS_MNEMONIC_CMP || - itr->instr.mnemonic == ZYDIS_MNEMONIC_CMC || itr->instr.mnemonic == ZYDIS_MNEMONIC_STC ) + static const std::vector< ZydisMnemonic > blacklist = { ZYDIS_MNEMONIC_CLC, ZYDIS_MNEMONIC_BT, + ZYDIS_MNEMONIC_TEST, ZYDIS_MNEMONIC_CMP, + ZYDIS_MNEMONIC_CMC, ZYDIS_MNEMONIC_STC }; + + if ( std::find( blacklist.begin(), blacklist.end(), itr->instr.mnemonic ) != blacklist.end() ) { routine.erase( itr ); break;