Closed wongsyrone closed 1 year ago
To summarize, I fixed two important issues.
Please feel free to partially merge or cherry-pick.
Interesting problems, I like the fix here. It makes sense the ff 25 length wouldn't include the data chunk as that can be far away, but we should be fine to always pretend it's adjacent. I will test out the linking changes on master to see if they're ok
I was looking back over this, why is "x64 FF25 jump takes 14 bytes in total, 6 for the jmp, 8 for the actual destination. The instructions overwritten by the 8 bytes are not taken into account" required? The destination holder for the ff 25 jump is not adjacent to the jmp and is intentionally placed into scratch space or a near heap allocation - was it corrupting something adjacent or?
I will retest without ff25 changes.
The most important one is fix overwritten prolog size calculation when using x64 FF25 jump
I'm doing mid-function hook, I want to hook just before the 'CALL' instruction.
before my fix:
after my fix: