diff --git a/src/hooking.c b/src/hooking.c index 491a9ff1e..152df9155 100644 --- a/src/hooking.c +++ b/src/hooking.c @@ -571,12 +571,17 @@ static int _hook_determine_start(hook_t *h) continue; } - // jmp dword [addr] - if(*addr == 0xff && addr[1] == 0x25) { - unhook_detect_add_region(h->funcname, addr, addr, addr, 6); - + // jmp dword [addr] / jmp qword [addr] + if((*addr == 0xff && addr[1] == 0x25) || (*addr == 0x48 && addr[1] == 0xff && addr[2] == 0x25)) { + if(*addr == 0xff) + unhook_detect_add_region(h->funcname, addr, addr, addr, 6); + else + unhook_detect_add_region(h->funcname, addr, addr, addr, 7); #if __x86_64__ - addr += *(int32_t *)(addr + 2) + 6; + if(*addr == 0xff) + addr += *(int32_t *)(addr + 2) + 6; + else + addr += *(int32_t *)(addr + 3) + 7; #else addr = *(uint8_t **)(addr + 2); #endif diff --git a/utils/process.py b/utils/process.py index b49a54f03..11df7c0c4 100755 --- a/utils/process.py +++ b/utils/process.py @@ -467,7 +467,7 @@ def process(self): sigs.append({ "library": insn["module_clean"], "apiname": insn["funcname"], - "ignore": last == insn["funcname"], + "ignore": last == insn["module"] + insn["funcname"], "is_insn": True, "is_hook": True, "signature": { @@ -479,7 +479,7 @@ def process(self): }, "logging": logging, }) - last = insn["funcname"] + last = insn["module"] + insn["funcname"] # Assign hook indices accordingly (in a sorted manner). for idx, sig in enumerate(sigs):