microsoft / microsoft/Detours

Issue when re-setting instruction pointer after hook removal in AMD64 architecture

Open
#3 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug enhancement help-wanted
Dominant language
C++
Stars
6.4k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Hello,
Detours provides the very convenient capability to suspend other threads than the one doing the unhooking,
And will update the instruction pointer of these suspended threads if they happen to be executing a trampoline that is being removed.

The issue I am seeing happens on AMD64 architectures in a multithreaded environment.
Since the hooks are more direct in X86, I am almost certain that it cannot happen in X86. I have no idea about ARM architectures.

On AMD64 processors, the hooks jump to the following pattern “0xff 25 f2 ff ff ff”, i.e.
“jmp qword [rip-0xe]”, with “rip-0xe” containing the address of the function that we wish to call.

I observe that when Rip points to the instruction above in one of the suspended threads, and the hook is removed, Detours does not update Rip in the thread context.
Rip is only updated in the suspended thread context if it pointed to an instruction inside the trampoline being deleted.
Here, the “jmp qword [rip-0xe]” is not inside the trampoline, so no updating of Rip takes place.
But when the thread is resumed, the memory containing the instruction or address has been deleted or zeroed out by the unhooking thread --> there will be a crash.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file, test, or code entry point is named. Start by tracing AMD64 thread-context instruction-pointer updates during hook removal, then reproduce the multithreaded case; done means a resumed thread cannot execute removed hook or trampoline memory.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.