DarthTon / Blackbone

Windows memory hacking library
MIT License
4.85k stars 1.34k forks source link

asmjit 64-bit jump relative address exception #380

Open nblog opened 4 years ago

nblog commented 4 years ago

sample:

    auto handler = AsmFactory::GetAssembler();
    auto& asmCore = *handler;
    asmCore->jmp(asmCore->intptr_ptr_abs(MAXDWORD + 1));
    auto func = reinterpret_cast<void(*)()>(asmCore->make());
    printf_s("size: %zu\n", asmCore->getCodeSize());
    printf_s("hex code: ");
    for (size_t i = 0; i < asmCore->getCodeSize(); i++)
        printf_s("%02X ", reinterpret_cast<PBYTE>(func)[i]);

x86 Compile: size: 6 hex code: FF 25 00 00 00 00

x64 Compile: size: 7 hex code: FF 24 25 00 00 00 00

jmp [a] ;ff 24 25 00 00 00 00 - 32-bit absolute jmp [rel a] ;ff 25 e7 ff ff ff - RIP + 32-bit displacement jmp [rdi] ;ff 27 - base pointer jmp [rdi +4rsi + a] ;ff a4 b7 00 00 00 00 - base pointer +4index + displacement

nblog commented 4 years ago

Because with the 0x24 modifier It is equivalent to a 64-bit relative jump address which can only be an absolute address of a 32-bit address, It also proves that it cannot jump to a 64-bit relative address. Snipaste_2020-01-05_02-50-57 Snipaste_2020-01-05_02-51-08 Snipaste_2020-01-05_02-59-13

nblog commented 4 years ago

Should be "intptr_ptr_abs" does not support 64-bit addresses. I got the same error using "AsmCore->mov (AsmCore->zcx, AsmCore->intptr_ptr_abs (MAXDWORD + 1));"

DarthTon commented 4 years ago

Does latest version of asmjit fix this?

nblog commented 4 years ago

yes