microsoft / Detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.
MIT License
5k stars 978 forks source link

Incorrect Behaviour: Arm64 CopyLdrLiteral for non-SIMD inlines Pointer Read #305

Open Sewer56 opened 8 months ago

Sewer56 commented 8 months ago

Describe the bug

In the following detours code,

https://github.com/microsoft/Detours/blob/4b8c659f549b0ab21cf649377c7a84eb708f5e68/src/disasm.cpp#L4241-L4251

which rewrites LDR Literal, the value of a PC relative address is directly inlined into the register.

i.e. Detours transforms it into a sequence of MOVZ + MOVK.

This is problematic if the value behind the PC relative address changes. For example, if the relative address points into the .data segment in order to read/write a global variable; and the value of the variable changes, Detours' rewritten code will no longer insert the correct value into the register as it has inlined the old value.

Expected behavior

A read of PC relative address should not be inlined, as the value behind this offset is not guaranteed to be constant.

Additional context

I'm building a cross platform, multi architecture hooking library [big WIP]; and I found detours' source to be pretty invaluable as a reference for code rewriting.

This is just a small thing I noticed while working on code rewriting on my end while referencing detours.