Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-01 00:32:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1666571 - Part 2. Support CALL [disp32] for Avast. r=handyman

Browse Source 
The last Avast Antivirus's hook function contains `CALL [disp32]` instruction.
Our detour needs to be able to handle that pattern.

Differential Revision: https://phabricator.services.mozilla.com/D91155
This commit is contained in:
Toshihito Kikuchi 2020-09-25 23:18:02 +00:00
parent 05e886ea80
commit abfd030f16
3 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
mozglue/misc/interceptor/PatcherDetour.h
View File

@ -1470,6 +1470,14 @@ class WindowsDllDetourPatcher final
if (mod == kModReg && (reg == 0 || reg == 1 || reg == 2 || reg == 6)) {
// INC|DEC|CALL|PUSH r64
COPY_CODES(2);
} else if (mod == kModNoRegDisp && reg == 2 &&
rm == kRmNoRegDispDisp32) {
// FF 15 CALL [disp32]
origBytes += 2;
if (!GenerateJump(tramp, origBytes.ChasePointerFromDisp(),
JumpType::Call)) {
return;
}
} else if (reg == 4) {
// FF /4 (Opcode=ff, REG=4): JMP r/m
if (mod == kModNoRegDisp && rm == kRmNoRegDispDisp32) {

7
mozglue/tests/interceptor/AssemblyPayloads.h
View File

@ -99,6 +99,13 @@ __declspec(dllexport) __attribute__((naked)) void OpcodeFF() {
"int $3;int $3;int $3;int $3;"
"int $3;int $3;int $3;int $3;");
}
__declspec(dllexport) __attribute__((naked)) void IndirectCall() {
asm volatile(
"call *(%rip);" // Indirect call to 0x90909090`90909090
"nop;nop;nop;nop;nop;nop;nop;nop;"
"ret;");
}
# elif defined(_M_IX86)
constexpr uintptr_t JumpDestination = 0x7fff0000;

1
mozglue/tests/interceptor/TestDllInterceptor.cpp
View File

@ -731,6 +731,7 @@ struct TestCase {
// a trampoline address instead of the original destination.
TestCase("NearJump", NoStubAddressCheck),
TestCase("OpcodeFF", NoStubAddressCheck),
TestCase("IndirectCall", NoStubAddressCheck),
# elif defined(_M_IX86)
// Skip the stub address check as we always generate a trampoline for x86.
TestCase("PushRet", NoStubAddressCheck),