search

lunixbochs / patchkit

binary patching from Python
Other
631 stars 85 forks source link

The hook api #10

Open zh-explorer opened 8 years ago

zh-explorer commented 8 years ago

Hello,I really like this project and It help me a lot . I found the hook api is not work well with pie .I see the patch and found that when hook paste origin code back ,It use a hardcore address.

lunixbochs commented 8 years ago

I don't like the fact the hook API requires RWX either. I want to lift and re-emit the replaced instructions where possible, like this:

original code:

    mov eax, 1
    mov eax, 2
    mov eax, 3
    mov eax, 4

hooked code:

    call trampoline
    mov eax, 2
    mov eax, 3
    mov eax, 4

trampoline:
    call hook_dst
    mov eax, 1
    ret

This should be safe during most function prologs, and is mostly an issue in the case of position-independent jumps or data loads.

zh-explorer commented 8 years ago

oh,I agree with it. The position-independent jumps seem not a problem because I seem the patch api always patch jmp as position-independent. So the problem is how to load disassemble.

lunixbochs commented 7 years ago

Position independent hooking should work in d5f175d74c1e6b594215d1a0cae9bcaf4290ff4c, can you confirm? The memcpy is now pc-relative.