microsoft / microsoft/Detours

Incorrect Behaviour: Arm64 CopyLdrLiteral for non-SIMD inlines Pointer Read

Open
#305 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
6.4k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

In the following detours code,

https://github.com/microsoft/Detours/blob/4b8c659f549b0ab21cf649377c7a84eb708f5e68/src/disasm.cpp#L4241-L4251

which rewrites LDR Literal, the value of a PC relative address is directly inlined into the register.

i.e. Detours transforms it into a sequence of MOVZ + MOVK.

This is problematic if the value behind the PC relative address changes. For example, if the relative address points into the .data segment in order to read/write a global variable; and the value of the variable changes, Detours' rewritten code will no longer insert the correct value into the register as it has inlined the old value.

Expected behavior

A read of PC relative address should not be inlined, as the value behind this offset is not guaranteed to be constant.

Additional context

I'm building a cross platform, multi architecture hooking library [big WIP]; and I found detours' source to be pretty invaluable as a reference for code rewriting.

This is just a small thing I noticed while working on code rewriting on my end while referencing detours.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/disasm.cpp around lines 4241-4251 and review the Arm64 non-SIMD LDR Literal rewrite. Check how the rewritten sequence handles a PC-relative address whose target value can change. Done means the transformation preserves current memory-read behavior instead of embedding an earlier value, with regression coverage for a mutable target.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.