v1.0.6

v1.0.6 — Root cause fix

Root Cause (confirmed)

VirtualAlloc(NULL, ...) can return memory >2GB from the target function. On x64 this causes:

1. 32-bit tail JMP overflow → wrong address.
2. (int)(func - tramp) truncation → wrong RIP-relative adjustment.
3. AccessViolationException.

MinHook/Detours solve this by allocating within a fixed range of the target.

Fixes

1. alloc_near() — Allocates within 512MB of target using VirtualQuery (MinHook algorithm).
2. Diff overflow guard — Explicit check before using (int)diff.
3. Comprehensive rip_disp_off() — Blacklist of non-ModRM opcodes instead of incomplete whitelist.
4. Complete inst_len() — All missing ModRM opcodes (ADD r/m8,r8, MOVSXD, IMUL imm, Group 2/4, SETcc, CMPXCHG, XADD, RET imm16, etc.)

Status

36/36 decoder tests pass.

Full Changelog: v1.0.5...v1.0.6