Skip to content

v1.0.4

Choose a tag to compare

View all tags
@DoubleAAGuy DoubleAAGuy released this 17 May 04:19
· 4 commits to master since this release
v1.0.4
f8b8df1

Fixes

  • Fixed instruction decoder missing 0xFF opcode: on modern Windows, kernel32!CreateProcessW is a 6-byte indirect JMP (FF 25 xx xx xx xx = JMP [rip+offset]). The decoder didn't handle 0xFF at all, causing it to save only 5 bytes of this 6-byte instruction → trampoline executed a partial instruction → AccessViolationException.
  • Also added 0x8F (POP r/m), 0x6A (PUSH imm8), 0x68 (PUSH imm32) to the x64 decoder.

Full Changelog: v1.0.3...v1.0.4

Assets 4
Loading