retour 0.3.1

A cross-platform detour library written in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

use crate::pic::Thunkable;
use std::mem;

#[repr(packed)]
struct CallAbs {
  // call [rip+8]
  opcode0: u8,
  opcode1: u8,
  dummy0: u32,
  // jmp +10
  dummy1: u8,
  dummy2: u8,
  // destination
  address: usize,
}

pub fn call_abs(destination: usize) -> Box<dyn Thunkable> {
  let code = CallAbs {
    opcode0: 0xFF,
    opcode1: 0x15,
    dummy0: 0x0_0000_0002,
    dummy1: 0xEB,
    dummy2: 0x08,
    address: destination,
  };

  let slice: [u8; 16] = unsafe { mem::transmute(code) };
  Box::new(slice.to_vec())
}

#[repr(packed)]
struct JumpAbs {
  // jmp +6
  opcode0: u8,
  opcode1: u8,
  dummy0: u32,
  // destination
  address: usize,
}

pub fn jmp_abs(destination: usize) -> Box<dyn Thunkable> {
  let code = JumpAbs {
    opcode0: 0xFF,
    opcode1: 0x25,
    dummy0: 0x0_0000_0000,
    address: destination,
  };

  let slice: [u8; 14] = unsafe { mem::transmute(code) };
  Box::new(slice.to_vec())
}

#[repr(packed)]
struct JccAbs {
  // jxx + 16
  opcode: u8,
  dummy0: u8,
  dummy1: u8,
  dummy2: u8,
  dummy3: u32,
  // destination
  address: usize,
}

pub fn jcc_abs(destination: usize, condition: u8) -> Box<dyn Thunkable> {
  let code = JccAbs {
    // Invert the condition in x64 mode to simplify the conditional jump logic
    opcode: 0x71 ^ condition,
    dummy0: 0x0E,
    dummy1: 0xFF,
    dummy2: 0x25,
    dummy3: 0x0000_0000,
    address: destination,
  };

  let slice: [u8; 16] = unsafe { mem::transmute(code) };
  Box::new(slice.to_vec())
}