search

vezel-dev / ruptura

A Windows DLL injection, function interception, and memory manipulation library for .NET.
https://docs.vezel.dev/ruptura
BSD Zero Clause License
38 stars 2 forks source link

`CallTrace`: Disassemble managed prestubs to find the real method address #26

Open alexrp opened 2 years ago

alexrp commented 2 years ago

https://github.com/vezel-dev/ruptura/blob/70168266ca273ec99eee6baba89522c896150db6/src/memory/Diagnostics/CallFrame.cs#L43-L45

The issue is that the function pointer we get from RuntimeMethodHandle.GetFunctionPointer() points to the prestub for the method, but the instruction pointer we have (of course) points to the actual JIT'd method that was executed.

One way we might solve this is by disassembling the prestub and following the jump to the actual method. But we would need to know for sure that RuntimeMethodHandle.GetFunctionPointer() always returns a pointer to a prestub.

alexrp commented 2 years ago

Lots of useful information here: https://github.com/MonoMod/MonoMod.Common/blob/master/RuntimeDetour/Platforms/Runtime/DetourRuntimeNETPlatform.cs

Looks like this is not going to be fun.