Possible bug on x64?

[tsudakageyu]

Possible bug on x64?

[m417z]

The trampoline which is patched over the function is always JMP_REL, so it looks correct.

[PsychloDx]

That is not true.

When x64 the patch happens using JMP_ABS:

JMP_ABS jmp = { 0xFF, 0x25, 0x00000000, // FF25 00000000: JMP [RIP+6] 0x0000000000000000ULL // Absolute destination address };

#if defined(_M_X64) || defined(__x86_64__) jmp.address = pOldInst; #else

typedef struct _JMP_ABS { UINT8 opcode0; // FF25 00000000: JMP [+6] UINT8 opcode1; UINT32 dummy; UINT64 address; // Absolute destination address } JMP_ABS, *PJMP_ABS;

In x64 the patch size is actually 14. And JMP_REL will always have size of 5.

[m417z]

You mix up two jumps: the jump which is patched over the hooked function, and the jump which is followed after the first saved commands of the function (which is written in a separately allocated buffer).