3 ms·
Yeah but what if they have a branch target in the prologue?
by 05 10y ago
Yeah but what if they have a branch target in the prologue?
- Keyframe 10y agoYes.
- mxmauro 10y agoWhen the stub for calling the original function is created, most hooking engines assumes the prologue contains the standard "mov edi,edi/push ebp/mov ebp,esp" and it is wrong. If the prologue contains, for e.g., a relative jmp, copying opcodes is not enough. You must convert it to an absolute jump in the generated stub. The same applies to several instructions doing relative/indirect addressing.