Re:x86 API Hooking Demystified (2012)
by jchw on Wednesday July 10, 2019 @10:22AM
(#20402188)
Well the bigger problem imo is other hook engines that might also be roaming around the process space. I think all you need is two extra bytes to make it valid instructions, and in theory then nested hooking should work fine. Though it only exacerbates the length issue.
[ Parent
| on HN ]
Re:x86 API Hooking Demystified (2012)
by stevemk14ebr on Wednesday July 10, 2019 @09:59PM
(#20408506)
if you place the data at the end of the trampoline it avoids these issues of mixing data and code, it's like a little custom data segment you make since you have to allocate the trampoline anyways. This is what i do in my lib. The disp is after the jmp the trampoline uses to jmp back to the original. The original function only has the jmp [disp] and no data is mixed.