Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect Behaviour: Arm64 CopyLdrLiteral for non-SIMD inlines Pointer Read #305

Open
Sewer56 opened this issue Nov 1, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@Sewer56
Copy link

Sewer56 commented Nov 1, 2023

Describe the bug

In the following detours code,

Detours/src/disasm.cpp

Lines 4241 to 4251 in 4b8c659

else if (decoded.s.FpNeon == 0)
{
UINT64 value = 0;
switch (decoded.s.Size)
{
case 0: value = *(ULONG*)pTarget; break;
case 1: value = *(UINT64*)pTarget; break;
case 2: value = *(LONG*)pTarget; break;
}
EmitMovImmediate(pDstInst, decoded.s.Rt, value);
}

which rewrites LDR Literal, the value of a PC relative address is directly inlined into the register.

i.e. Detours transforms it into a sequence of MOVZ + MOVK.

This is problematic if the value behind the PC relative address changes. For example, if the relative address points into the .data segment in order to read/write a global variable; and the value of the variable changes, Detours' rewritten code will no longer insert the correct value into the register as it has inlined the old value.

Expected behavior

A read of PC relative address should not be inlined, as the value behind this offset is not guaranteed to be constant.

Additional context

I'm building a cross platform, multi architecture hooking library [big WIP]; and I found detours' source to be pretty invaluable as a reference for code rewriting.

This is just a small thing I noticed while working on code rewriting on my end while referencing detours.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant