News for hackers. Stuff that matters.
Re:Google XRay: A Function Call Tracing System [pdf] by mxmauro on Tuesday May 03, 2016 @06:44AM (#11619402)
When the stub for calling the original function is created, most hooking engines assumes the prologue contains the standard "mov edi,edi/push ebp/mov ebp,esp" and it is wrong.

If the prologue contains, for e.g., a relative jmp, copying opcodes is not enough. You must convert it to an absolute jump in the generated stub. The same applies to several instructions doing relative/indirect addressing.

There are no comments on this comment yet.