Skip to content

Fix Linux hook/unhook crashes#16

Open
reinismu wants to merge 2 commits into
regomne:masterfrom
reinismu:master
Open

Fix Linux hook/unhook crashes#16
reinismu wants to merge 2 commits into
regomne:masterfrom
reinismu:master

Conversation

@reinismu
Copy link
Copy Markdown

@reinismu reinismu commented Feb 4, 2025

While using the lib I noticed 3 issues.

  1. I call hook/unhook with ptrace so there is a risk that code is currently in the trampoline. If that is the case it crashes.
    LEAVE_TRAMPOLINE solves it

  2. There is a chance that when we do mprotect aligned to page that trampoline code goes in next page as well.
    Changed protection to next page as well

  3. I'm not too sure about this one, but movaps requires stack to be aligned at 0x16 bytes. Windows programs compile to it by default, but not linux. movups doesnt need that

@regomne
Copy link
Copy Markdown
Owner

regomne commented Feb 11, 2025

For 1, unhook should only be called when the caller knows that code is not and will not run in the trampoline nor the being hooked address. Is there a case where developers cannot know that?
For 3, code x64.rs:352 tries to aligned the rsp to 0x10. Does it not work?

@reinismu
Copy link
Copy Markdown
Author

reinismu commented Feb 12, 2025

1 - In my case I just inject/eject my lib.so in the running process. So can't have any guarantees
3 - Ohh maybe I jumped the gun on this one. I just got multiple crashes at movaps so thought that must be it. Also I'm in unique situation where I call windows functions from linux. From what I read there is Windows shadow space that linux doesnt have and I had to add more stack aligning in my code

@regomne regomne closed this Oct 25, 2025
@reinismu
Copy link
Copy Markdown
Author

  1. and 3. might not be an issue, but 2. was an issue for me for sure
 mprotect(
                (addr & !(page_size as usize - 1)) as *mut c_void,
                // There is a risk where our code is at the end of a page and runs into non executable memory
                // So we need to change the next page as well
                (page_size as usize) * 2,
                7,
            )

I would have another look over it

@regomne
Copy link
Copy Markdown
Owner

regomne commented Oct 26, 2025

Yes, you are right. Is there a method to check if it is in an edge? So that we don't need to modify 2 pages every time.
And, why the length parameter didn't work?

@regomne regomne reopened this Oct 26, 2025
@reinismu
Copy link
Copy Markdown
Author

I assume need to check what is the page size (I guess 4KB for most) and then check if (addr + length) % page < length then we know it overflows. Tho havent checked how exactly paging works. Allocating 2 pages just solve the issue

@regomne
Copy link
Copy Markdown
Owner

regomne commented Oct 26, 2025

I would prefer to use a more precise method to modify the memory attributes. If you're willing to provide the code, please make the changes directly in the PR. Otherwise, I will try to modify it myself later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants