News for hackers. Stuff that matters.
Re:Google XRay: A Function Call Tracing System [pdf] by 05 on Monday May 02, 2016 @06:22PM (#11616201)
Yeah but what if they have a branch target in the prologue?
Re:Google XRay: A Function Call Tracing System [pdf] by mxmauro on Tuesday May 03, 2016 @06:44AM (#11619402)
When the stub for calling the original function is created, most hooking engines assumes the prologue contains the standard "mov edi,edi/push ebp/mov ebp,esp" and it is wrong.

If the prologue contains, for e.g., a relative jmp, copying opcodes is not enough. You must convert it to an absolute jump in the generated stub. The same applies to several instructions doing relative/indirect addressing.

Re:Google XRay: A Function Call Tracing System [pdf] by Keyframe on Monday May 02, 2016 @06:38PM (#11616315)
Yes.