-
Notifications
You must be signed in to change notification settings - Fork 124
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
trampoline fails on X86_64 due to "endbr64" instruction not handled? #61
Comments
As some added information, I found on the Internet some mention that compiling with GCC with "-mmanual-endbr" may help. So on my GCC 9.3 test I did this, and now the function foo becomes:
so the endbr64 instruction is gone. But now I run into "offset too large issue", in gdb I have: subhook_make_trampoline (trampoline=0x40000000, src=0x5555555552bb , jmp_size=14, trampoline_len=0x5555555596f0, flags=SUBHOOK_64BIT_OFFSET) and diff between 0x40000000 and 0x5555555552bb is too large and I fail at:
Is there no workaround this problem? Why can't the trampoline code overcome this limit by doing some jump via RIP register or something? (Sorry, I have limited knowledge of Intel 64 bit instruction extensions, (AMD's extensions I believe.)) |
Pull request #58 can help address this issue on Linux. |
I am trying to create a trampoline to a function that in C is:
I am using gcc 9.3 on ubuntu 20.04 64 bit w/ Linux kernel 5.8.0-53-generic
Compiled code is:
And in bytes it is:
subhook_disasm() fails to decode this function. I have tried to understand subhook_diasm() but I can't tell just what the issue (or the fix) might me. Any hints welcome, including if problem is something else.
On older 64 bit linux system w/ GCC 4.4.7 this function is:
Here trampoline works fine (the difference that is important I believe is the "endbr64" at start when using GCC 9.3
The text was updated successfully, but these errors were encountered: