0

My program redirects a function to another function by writing a jmp instruction to the first few bytes of the function (only i386). It works like expected but it means that I can't call the original function anymore, because it will always jump to the new one.

There are two possible workarounds I could think of:

  1. Create a new function, which overwrites the jmp instruction of the target function and call it. Afterwards the function writes back the jmp instruction. But I'm not sure how to pass the arguments since there can be any number of them. And I wonder if the target function can jmp somewhere else and skip writing back the jmp instruction (like throw catch?).

  2. Create a new function which executes the code I have overwritten with the jmp instruction. But I can't be sure that the overwritten data is a complete instruction. I'd have to know how many bytes I have to copy for a complete instructions.

So, finally, my questions:

  1. Is there another way I didn't think of?

  2. How do I find the size of an instruction? I already looked at binutils and found this but I don't know how to interpret it.

Here is a sample:

mov, 2, 0xa0, None, 1, Cpu64, D|W|CheckRegSize|No_sSuf|No_ldSuf, { Disp64|Unspecified|Byte|Word|Dword|Qword, Acc|Byte|Word|Dword|Qword }

the 2nd column shows the number of operands (2) and the last column has information about the operands, seperated by a comma

I also found this question which is pretty much the same but I can't be sure that the 7 bytes contain a whole instruction. Writing a Trampoline Function

Any help is appreciated! Thanks.

4

2 回答 2

1

Sebastian, you can use the exe_load_symbols() function in hotpatch to get a list of the symbols and their location in the existing exe and then see if you can overwrite that in memory. I have not tried it yet. You may be able to do it with the LD_PRELOAD environment variable as well instead of hotpatch.

--Vikas

于 2014-09-04T20:35:33.727 回答
0

像这样的东西怎么样：

假设这是原始功能：

Instruction1
Instruction2
Instruction3
...
RET

将其转换为：

JMP new_stuff
old:
Instruction2
Instruction3
...
RET
...
new_stuff:
CMP call_my_function,0
JNZ my_function
Instruction1
JMP old
my_function:
...

当然，您必须考虑原始指令的大小（objdump例如，您可以通过反汇编来发现），以便第一个JMP完全适合（如果 s比原始指令短，则用NOPs填充） JMP）。

于 2013-02-26T11:04:14.387 回答