fix: add 0x0F (two-byte opcode prefix) to valid prologue bytes
Browse filesFunctions starting with MOVZX/MOVSX (0x0F B6/0x0F BE) were flagged as
unexpected prologues. This is valid for MSVC-generated code.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
crates/openwa-dll/src/startup_checks.rs
CHANGED
|
@@ -30,6 +30,7 @@ const VALID_PROLOGUES: &[u8] = &[
|
|
| 30 |
0x89, // mov reg, reg
|
| 31 |
0x8B, // mov reg, ...
|
| 32 |
0x8D, // lea reg, ...
|
|
|
|
| 33 |
0xA1, // mov eax, [imm32]
|
| 34 |
0xB8, // mov eax, imm32
|
| 35 |
0xC1, // shr/shl reg, imm8
|
|
|
|
| 30 |
0x89, // mov reg, reg
|
| 31 |
0x8B, // mov reg, ...
|
| 32 |
0x8D, // lea reg, ...
|
| 33 |
+
0x0F, // two-byte opcode prefix (e.g. movzx, movsx)
|
| 34 |
0xA1, // mov eax, [imm32]
|
| 35 |
0xB8, // mov eax, imm32
|
| 36 |
0xC1, // shr/shl reg, imm8
|