From a956987fe00eba3474b84b6d60d63269915e9375 Mon Sep 17 00:00:00 2001
From: Decaf Code <git@decafcode.org>
Date: Tue, 13 Nov 2018 19:28:45 -0500
Subject: [PATCH] hook/process.c: Fix 64-bit startup hijack

Start address goes in RCX in 64-bit mode, EAX in 32-bit mode.
---
 hook/process.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hook/process.c b/hook/process.c
index c846aa4..24bbb75 100644
--- a/hook/process.c
+++ b/hook/process.c
@@ -16,7 +16,7 @@ static bool thread_match_startup(
 {
 #ifdef __amd64
     return  ctx->Rip == (DWORD64) ntstart &&
-            ctx->Rax == (DWORD64) exe_entry;
+            ctx->Rcx == (DWORD64) exe_entry;
 #else
     return  ctx->Eip == (DWORD) ntstart &&
             ctx->Eax == (DWORD) exe_entry;
@@ -29,8 +29,8 @@ static void thread_patch_startup(
         CONTEXT *ctx)
 {
 #ifdef __amd64
-    *orig_entry = (void *) ctx->Rax;
-    ctx->Rax = (DWORD64) new_entry;
+    *orig_entry = (void *) ctx->Rcx;
+    ctx->Rcx = (DWORD64) new_entry;
 #else
     *orig_entry = (void *) ctx->Eax;
     ctx->Eax = (DWORD) new_entry;