3 ms·
Can Deviare handle rewriting RIP-relative instructions over 5 bytes long starting within the first 5 bytes? E.g.: 0:000> uf python27!Py_GetPath python27!P
by trentnelson 10y ago
Can Deviare handle rewriting RIP-relative instructions over 5 bytes long starting within the first 5 bytes? E.g.:
0:000> uf python27!Py_GetPath
python27!Py_GetPath [c:\minonda\conda-bld\work\python-2.7.12\pc\getpathp.c @ 688]:
688 00000000`1e1054f0 4883ec28 sub rsp,28h
689 00000000`1e1054f4 488b055dc51d00 mov rax,qword ptr [python27!module_search_path (00000000`1e2e1a58)]
That second mov instruction will get trampled if you overwrite the `sub rsp,28h` with a jmp, so you need to relocate it as well, which requires re-calculating the RIP-relative IMM32 address embedded within the instruction.
I've found a lot of hooking libraries couldn't handle that.
- mxmauro 10y agoHi @threntnelson, yes. The generated code will consist in a copy the sub opcode and the mov will be converted to an absolute mov. Sometimes there is no 1-1 conversion so they are converted to several instructions preserving register values if they must be temporarily used.