Issue when re-setting instruction pointer after hook removal in AMD64 architecture
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 6.4k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
Detours provides the very convenient capability to suspend other threads than the one doing the unhooking,
And will update the instruction pointer of these suspended threads if they happen to be executing a trampoline that is being removed.
The issue I am seeing happens on AMD64 architectures in a multithreaded environment.
Since the hooks are more direct in X86, I am almost certain that it cannot happen in X86. I have no idea about ARM architectures.
On AMD64 processors, the hooks jump to the following pattern “0xff 25 f2 ff ff ff”, i.e.
“jmp qword [rip-0xe]”, with “rip-0xe” containing the address of the function that we wish to call.
I observe that when Rip points to the instruction above in one of the suspended threads, and the hook is removed, Detours does not update Rip in the thread context.
Rip is only updated in the suspended thread context if it pointed to an instruction inside the trampoline being deleted.
Here, the “jmp qword [rip-0xe]” is not inside the trampoline, so no updating of Rip takes place.
But when the thread is resumed, the memory containing the instruction or address has been deleted or zeroed out by the unhooking thread --> there will be a crash.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or code entry point is named. Start by tracing AMD64 thread-context instruction-pointer updates during hook removal, then reproduce the multithreaded case; done means a resumed thread cannot execute removed hook or trampoline memory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100