hde displacement size under x64

[shatyuka]

Description:
For a 0x67 prefixed x64 instruction, hde will recognize it's displacement as 16bit. (maybe just copied from hde32?)

minhook/src/hde/hde64.c

Line 246 in 7819161

disp_size = 2;

Possible fix:

        switch (m_mod) {
            case 0:
                if (m_rm == 5)
                    disp_size = 4;
                break;
            case 1:
                disp_size = 1;
                break;
            case 2:
                disp_size = 4;
                break;
        }

Test:

.CODE

FuncInc PROC
    lea eax, [ecx+10000h]
    ret
FuncInc ENDP

END

Try hooking this function under x64 and call ppOrigin.

Origin function:

Backup function: