Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I patch a Windows API at runtime so that it to returns 0 in x64?

In x86, I get the function address using GetProcAddress() and write a simple XOR EAX,EAX; RET 4; in it. Simple and effective. How do I do the same in x64?

bool DisableSetUnhandledExceptionFilter()
{
  const BYTE PatchBytes[5] = { 0x33, 0xC0, 0xC2, 0x04, 0x00 }; // XOR EAX,EAX; RET 4;

  // Obtain the address of SetUnhandledExceptionFilter 
  HMODULE hLib = GetModuleHandle( _T("kernel32.dll") );
  if( hLib == NULL )
    return false;
  BYTE* pTarget = (BYTE*)GetProcAddress( hLib, "SetUnhandledExceptionFilter" );
  if( pTarget == 0 )
    return false;

  // Patch SetUnhandledExceptionFilter 
  if( !WriteMemory( pTarget, PatchBytes, sizeof(PatchBytes) ) )
    return false;
  // Ensures out of cache
  FlushInstructionCache(GetCurrentProcess(), pTarget, sizeof(PatchBytes));

  // Success 
  return true;
}

static bool WriteMemory( BYTE* pTarget, const BYTE* pSource, DWORD Size )
{
  // Check parameters 
  if( pTarget == 0 )
    return false;
  if( pSource == 0 )
    return false;
  if( Size == 0 )
    return false;
  if( IsBadReadPtr( pSource, Size ) )
    return false;
  // Modify protection attributes of the target memory page 
  DWORD OldProtect = 0;
  if( !VirtualProtect( pTarget, Size, PAGE_EXECUTE_READWRITE, &OldProtect ) )
    return false;
  // Write memory 
  memcpy( pTarget, pSource, Size );
  // Restore memory protection attributes of the target memory page 
  DWORD Temp = 0;
  if( !VirtualProtect( pTarget, Size, OldProtect, &Temp ) )
    return false;
  // Success 
  return true;
}

This example is adapted from code found here: http://www.debuginfo.com/articles/debugfilters.html#overwrite .

like image 883
Jorge Vasquez Avatar asked Oct 20 '25 01:10

Jorge Vasquez


1 Answers

In x64 the return value is in RAX, which is the 64bit version of EAX. But because the upper 32 bits are cleared when a 32 bit sub-register is written, "xor eax, eax" is equivalent to "xor rax, rax" and doesn't need to be changed.

However, because the calling convention is different on x64, the same return instruction won't work there: In x86 winapi functions use the stdcall convention, where the callee pops the arguments from the stack (hence the "retn 4" instruction, which pops that one argument from SetUnhandledExceptionFilter off the stack (you may want to fix that comment in your code)). In x64 the stack is not cleaned by the callee, so a normal "retn" instruction needs to be used:

const BYTE PatchBytes[3] = { 0x33, 0xC0, 0xC3 }; // XOR EAX,EAX; RET;
like image 196
mfya Avatar answered Oct 22 '25 03:10

mfya



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!