NTSTATUS CmGenerateMovReg (
PUCHAR pCode,
PULONG pGeneratedCodeLength,
ULONG Register,
ULONG64 Value
)
{
ULONG uCodeLength;
if (!pCode || !pGeneratedCodeLength)
return STATUS_INVALID_PARAMETER;
switch (Register & ~REG_MASK) {
case REG_GP:
pCode[0] = 0x48;
pCode[1] = 0xb8 | (UCHAR) (Register & REG_MASK);
memcpy (&pCode[2], &Value, 8);
uCodeLength = 10;
break;
case REG_GP_ADDITIONAL:
pCode[0] = 0x49;
pCode[1] = 0xb8 | (UCHAR) (Register & REG_MASK);
memcpy (&pCode[2], &Value, 8);
uCodeLength = 10;
break;
case REG_CONTROL:
uCodeLength = *pGeneratedCodeLength;
CmGenerateMovReg (pCode, pGeneratedCodeLength, REG_RAX, Value);
// calc the size of the "mov rax, value"
uCodeLength = *pGeneratedCodeLength - uCodeLength;
pCode += uCodeLength;
uCodeLength = 0;
if (Register == (REG_CR8)) {
// build 0x44 0x0f 0x22 0xc0
pCode[0] = 0x44;
uCodeLength = 1;
pCode++;
Register = 0;
}
// mov crX, rax
pCode[0] = 0x0f;
pCode[1] = 0x22;
pCode[2] = 0xc0 | (UCHAR) ((Register & REG_MASK) << 3);
// *pGeneratedCodeLength has already been adjusted to the length of the "mov rax"
uCodeLength += 3;
}
if (pGeneratedCodeLength)
*pGeneratedCodeLength += uCodeLength;
return STATUS_SUCCESS;
}
// generate binary code
NTSTATUS NTAPI CmGenerateMovReg (
PUCHAR pCode,
PULONG pGeneratedCodeLength,
ULONG Register,
ULONG Value
)
{ //Finished
ULONG uCodeLength;
if (!pCode || !pGeneratedCodeLength)
return STATUS_INVALID_PARAMETER;
switch (Register & ~REG_MASK)
{
case REG_GP:
pCode[0] = 0xb8 | (UCHAR) (Register & REG_MASK);
memcpy (&pCode[1], &Value, 4);
uCodeLength = 5;
break;
case REG_GP_ADDITIONAL:
pCode[0] = 0xb8 | (UCHAR) (Register & REG_MASK);
memcpy (&pCode[1], &Value, 4);
uCodeLength = 5;
break;
case REG_CONTROL:
uCodeLength = *pGeneratedCodeLength;
CmGenerateMovReg (pCode, pGeneratedCodeLength, REG_RAX, Value);
// calc the size of the "mov rax, value"
uCodeLength = *pGeneratedCodeLength - uCodeLength;
pCode += uCodeLength;
// mov crX, rax
pCode[0] = 0x0f;
pCode[1] = 0x22;
pCode[2] = 0xc0 | (UCHAR) ((Register & REG_MASK) << 3);
// *pGeneratedCodeLength has already been adjusted to the length of the "mov rax"
uCodeLength = 3;
}
if (pGeneratedCodeLength)
*pGeneratedCodeLength += uCodeLength;
return STATUS_SUCCESS;
}