Skip to content

v1.0.5

Choose a tag to compare

View all tags
@DoubleAAGuy DoubleAAGuy released this 17 May 04:22
· 3 commits to master since this release
v1.0.5
163a9b6

Fixes

  • Fixed RIP-relative displacement in trampoline: when kernel32 functions like CreateProcessW start with an indirect JMP (FF 25 xx xx xx xx = JMP [rip+offset]), copying the instruction byte-for-byte into the trampoline produces a JMP to the wrong address — because rip differs between the original function and the trampoline. The displacement is now adjusted by func_addr - tramp_addr to compensate.

Status

Still crashing with AccessViolationException even after decoder fixes. This RIP-relative adjustment is the remaining likely cause.

Full Changelog: v1.0.4...v1.0.5

Assets 4
Loading