3 ms·
Intesting. ms_hook_prologue inserts 1 8-byte instruction ( lea rsp,[rsp+0x0]) instead of 8 1-byte nops. It executes much faster than 8 nopts if the function is
by eb0la 11y ago
Intesting. ms_hook_prologue inserts 1 8-byte instruction ( lea rsp,[rsp+0x0]) instead of 8 1-byte nops. It executes much faster than 8 nopts if the function is not patched (no need to decode 8 instructions).
- kevincox 11y agoIn the article it is also mentioned that it is important so that you can't have a thread that has "partially" executed your no-ops wen you replace it/them..