search

Hpmason / retour-rs

A cross-platform detour library written in Rust
Other
99 stars 18 forks source link

Bug with RIP relative addressing #42

Open VivekPanyam opened 8 months ago

VivekPanyam commented 8 months ago

The code that handles RIP relative addressing assumes that the displacement is always the last 4 bytes of the instruction:

https://github.com/Hpmason/retour-rs/blob/3bf7863bc0ad4ba1d0657e6ee98d43145c16b658/src/arch/x86/trampoline/mod.rs#L166-L167

This is not always true. CMP reg/mem32, imm32 is an example.

Locally, I fixed this by scanning the bytes of the original instruction for the original displacement value, making sure there's only one match, and then using that location as the index.

There's probably a cleaner way to do that (ideally you'd get the offset of the operand within the instruction from the disassembler). I can put up a PR if you'd like, but my code simply asserts that there's one matching location, which is probably not flexible enough to include in the library.

Hpmason commented 8 months ago

Good catch. There's currently a PR (#41) already replacing a chunk of that code, so we can make sure include a fix for this there.