Skip to content

Commit

Permalink
fix trampoline jump offset
Browse files Browse the repository at this point in the history
  • Loading branch information
altalk23 committed May 26, 2024
1 parent 61443a7 commit 428d713
Showing 1 changed file with 35 additions and 7 deletions.
42 changes: 35 additions & 7 deletions src/generator/X64Generator.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,21 @@ std::vector<uint8_t> X64HandlerGenerator::handlerBytes(uint64_t address) {
}

// preserve registers
a.sub(RSP, 0xb8);
#ifdef TULIP_HOOK_WINDOWS
constexpr auto PRESERVE_SIZE = 0x78;
a.sub(RSP, PRESERVE_SIZE);

a.mov(m[RSP + 0x58], R9);
a.mov(m[RSP + 0x50], R8);
a.mov(m[RSP + 0x48], RDX);
a.mov(m[RSP + 0x40], RCX);
a.movaps(m[RSP + 0x30], XMM3);
a.movaps(m[RSP + 0x20], XMM2);
a.movaps(m[RSP + 0x10], XMM1);
a.movaps(m[RSP + 0x00], XMM0);
#else
constexpr auto PRESERVE_SIZE = 0xb8;
a.sub(RSP, PRESERVE_SIZE);

a.mov(m[RSP + 0xa8], R9);
a.mov(m[RSP + 0xa0], R8);
Expand All @@ -61,13 +75,14 @@ std::vector<uint8_t> X64HandlerGenerator::handlerBytes(uint64_t address) {
a.movaps(m[RSP + 0x20], XMM2);
a.movaps(m[RSP + 0x10], XMM1);
a.movaps(m[RSP + 0x00], XMM0);
#endif

// preserve the original return
a.mov(SCRATCH, m[RSP + 0xb8]);
a.mov(SCRATCH, m[RSP + PRESERVE_SIZE]);

// set the new return
a.lea(FIRST_PARAM, "handlerCont");
a.mov(m[RSP + 0xb8], FIRST_PARAM);
a.mov(m[RSP + PRESERVE_SIZE], FIRST_PARAM);

// set the parameters
a.mov(FIRST_PARAM, "content");
Expand All @@ -78,6 +93,18 @@ std::vector<uint8_t> X64HandlerGenerator::handlerBytes(uint64_t address) {
a.call(SCRATCH);

// recover registers
#ifdef TULIP_HOOK_WINDOWS
a.movaps(XMM0, m[RSP + 0x00]);
a.movaps(XMM1, m[RSP + 0x10]);
a.movaps(XMM2, m[RSP + 0x20]);
a.movaps(XMM3, m[RSP + 0x30]);
a.mov(RCX, m[RSP + 0x40]);
a.mov(RDX, m[RSP + 0x48]);
a.mov(R8, m[RSP + 0x50]);
a.mov(R9, m[RSP + 0x58]);

a.add(RSP, PRESERVE_SIZE);
#else
a.movaps(XMM0, m[RSP + 0x00]);
a.movaps(XMM1, m[RSP + 0x10]);
a.movaps(XMM2, m[RSP + 0x20]);
Expand All @@ -93,7 +120,8 @@ std::vector<uint8_t> X64HandlerGenerator::handlerBytes(uint64_t address) {
a.mov(R8, m[RSP + 0xa0]);
a.mov(R9, m[RSP + 0xa8]);

a.add(RSP, 0xb8);
a.add(RSP, PRESERVE_SIZE);
#endif

// call the func
a.jmp(SCRATCH);
Expand Down Expand Up @@ -165,14 +193,14 @@ std::vector<uint8_t> X64HandlerGenerator::trampolineBytes(uint64_t address, size
RegMem64 m;
using enum X64Register;

auto difference = reinterpret_cast<int64_t>(m_address) - static_cast<int64_t>(address) - 5;
auto difference = reinterpret_cast<int64_t>(m_address) - static_cast<int64_t>(address) - 5 + offset;

if (difference <= 0x7fffffff && difference >= -0x80000000) {
a.jmp(reinterpret_cast<uint64_t>(m_address));
a.jmp(reinterpret_cast<uint64_t>(m_address) + offset);
}
else {
a.jmprip(0);
a.write64(reinterpret_cast<uint64_t>(m_address));
a.write64(reinterpret_cast<uint64_t>(m_address) + offset);
}

return std::move(a.m_buffer);
Expand Down

0 comments on commit 428d713

Please sign in to comment.