added ADDW virtual instruction

include/vmprofiler.hpp

@@ -64,6 +64,7 @@ namespace vm
 
             ADDQ,
             ADDDW,
+            ADDW,
 
             SHLQ,
             SHLDW,
@@ -137,6 +138,7 @@ namespace vm
 
             extern vm::handler::profile_t addq;
             extern vm::handler::profile_t adddw;
+            extern vm::handler::profile_t addw;
 
             extern vm::handler::profile_t shlq;
             extern vm::handler::profile_t shldw;
@@ -160,12 +162,13 @@ namespace vm
             extern vm::handler::profile_t vmexit;
 
             inline std::vector< vm::handler::profile_t * > all = {
-                &sregq,       &sregdw,     &sregw,       &lregq,      &lregdw,   &lconstq, &lconstbzxw,
-                &lconstbsxdw, &lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstdw, &addq,    &adddw,
-                &shlq,        &shldw,      &writeq,      &writedw,    &nandq,    &nanddw,
+                &sregq,      &sregdw,      &sregw,      &lregq,    &lregdw,  &lconstq, &lconstbzxw, &lconstbsxdw,
+                &lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstdw, &addq,    &adddw,   &addw,
 
-                &shrq,        &readq,      &readdw,      &mulq,       &pushvsp,  &divq,    &jmp,
-                &vmexit,      &call };
+                &shlq,       &shldw,       &writeq,     &writedw,  &nandq,   &nanddw,
+
+                &shrq,       &readq,       &readdw,     &mulq,     &pushvsp, &divq,    &jmp,        &vmexit,
+                &call };
         } // namespace profile
     }     // namespace handler
 } // namespace vm

src/vmprofiler.vcxproj

@@ -104,6 +104,7 @@
     <ClCompile Include="vmhandler.cpp" />
     <ClCompile Include="vminstrs.cpp" />
     <ClCompile Include="vmprofiles\add.cpp" />
+    <ClCompile Include="vmprofiles\call.cpp" />
     <ClCompile Include="vmprofiles\div.cpp" />
     <ClCompile Include="vmprofiles\jmp.cpp" />
     <ClCompile Include="vmprofiles\lconst.cpp" />

src/vmprofiler.vcxproj.filters

@@ -86,6 +86,9 @@
     <ClCompile Include="vminstrs.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="vmprofiles\call.cpp">
+      <Filter>Source Files\vmprofiles</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="..\include\transform.hpp">

src/vmprofiles/add.cpp

@@ -59,6 +59,33 @@ namespace vm
                                instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
                                instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
                     } } } };
+
+            vm::handler::profile_t addw = {
+                // ADD [RBP+8], AX
+                // PUSHFQ
+                // POP [RBP]
+                "ADDW",
+                ADDW,
+                NULL,
+                { { // ADD [RBP+8], AX
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                               instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
+                               instr.operands[ 0 ].mem.disp.value == 0x8 &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
+                    },
+                    // PUSHFQ
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
+                    },
+                    // POP [RBP]
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                               instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
+                    } } } };
         } // namespace profile
     }     // namespace handler
 } // namespace vm