microsoft / microsoft/Detours

Windows 11 ARM64 Processor x86, x64 COM API Hook Crash.

Open
#292 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
6.4k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Windows 11 ARM64 Processor x86, x64 COM Hook Crash.
We tested using the latest sources. (main - 2022-08-16 commit)
[Surface pro 9 Microsoft SQ3 3.00 GHz Windows 11 ARM64]

[success]

On Windows 11 ARM64, x64 processes are emulated. Therefore, ARM, ARM64, x86, and x64 processes operate in the ARM64 environment. There is no problem with win32 API Hooking of x86 and x64 processes in the ARM64 environment.
image

[crash]

The problem occurs when hooking the COM API of x86 and x64 processes in an ARM64 environment. Crash when running Detours samples/commem.
image

code - samples/commem/commem.cpp

https://github.com/microsoft/Detours/blob/734ac64899c44933151c1335f6ef54a590219221/samples/commem/commem.cpp#L95C4-L95C4

DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)RealIStreamWrite, MineIStreamWrite);
DetourTransactionCommit();

printf("commem: Calling Write w/o after attach.\n");

li.QuadPart = 1;
hr = pStream->lpVtbl->Write(pStream, &li, sizeof(li), NULL);  // <-- crash

ERROR_CODE: (NTSTATUS) 0xc000001d - { }

Is there anything else I need to do to hook COM API of x86,x64 process in ARM64 environment?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with samples/commem/commem.cpp at the reported DetourAttach and pStream->lpVtbl->Write call, using the referenced main commit. Reproduce the crash for x86 and x64 processes under Windows 11 ARM64 and inspect the COM hook path and 0xc000001d failure. Done means the cause is identified and the sample no longer crashes, or the required limitation is clearly established.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.