xaymar/BlitzPointer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

Incorrect Stack movement causing MAV and invalid Pointers. Woops.

Browse Source
This commit is contained in:
Michael Dirks
2016-02-06 00:16:32 +01:00
parent b12b20ff17
commit 7af64687cc
3 changed files with 1113 additions and 1109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BlitzPointer.cpp
+9 -3
View File
@@ -29,7 +29,9 @@ DLL_METHOD intptr_t DLL_CALL BP_GetReturnAddress() {
// Blitz uses X86 Call-Near (E8) instructions to call its own functions. // Blitz uses X86 Call-Near (E8) instructions to call its own functions.
// We can simply deduce the Return Address like this because of that. // We can simply deduce the Return Address like this because of that.
ReturnAddress = *reinterpret_cast<intptr_t*>(*reinterpret_cast<intptr_t*>(*reinterpret_cast<intptr_t*>(BasePointer)) - 8); //-- Parent_EBP = *EBP
//-- Parent_RP = Parent_EBP + 16
ReturnAddress = (*((intptr_t*)BasePointer) + 16);
return ReturnAddress; return ReturnAddress;
} }
@@ -45,15 +47,19 @@ DLL_METHOD intptr_t DLL_CALL BP_GetFunctionPointer()
// Blitz uses X86 Call-Near (E8) instructions to call its own functions. // Blitz uses X86 Call-Near (E8) instructions to call its own functions.
// We can simply deduce the Return Address like this because of that. // We can simply deduce the Return Address like this because of that.
ReturnAddress = *reinterpret_cast<intptr_t*>(*reinterpret_cast<intptr_t*>(*reinterpret_cast<intptr_t*>(BasePointer)) - 8); //-- Parent_EBP = *EBP
//-- Parent_RP = Parent_EBP + 16
ReturnAddress = *(intptr_t*)((*(intptr_t*)BasePointer) + 16);
// And since it's a Call-Near, the call is offset to the return address. // And since it's a Call-Near, the call is offset to the return address.
FunctionPointer = ReturnAddress + *reinterpret_cast<intptr_t*>(ReturnAddress - 4); FunctionPointer = ReturnAddress + *(intptr_t*)(ReturnAddress - 4);
return FunctionPointer; return FunctionPointer;
} }
#pragma comment(linker, "/EXPORT:BP_GetFunctionPointer=_BP_GetFunctionPointer@0") #pragma comment(linker, "/EXPORT:BP_GetFunctionPointer=_BP_GetFunctionPointer@0")
// Didn't work out, overloading a Runtime Function makes it disappear. // Didn't work out, overloading a Runtime Function makes it disappear.
// At 0x00100000 (Process begin stuff) there's a list of functions? What the hell Mark?
/*DLL_METHOD intptr_t DLL_CALL BP_GetLastCalledFunctionPointer( ) /*DLL_METHOD intptr_t DLL_CALL BP_GetLastCalledFunctionPointer( )
{ {
// Scan backwards in executable memory for a eax assign. // Scan backwards in executable memory for a eax assign.
BlitzPointer.decls
+1089 -1089
View File
File diff suppressed because it is too large Load Diff
BlitzPointer.vcxproj
+15 -17
View File
@@ -13,6 +13,7 @@
<PropertyGroup Label="Globals"> <PropertyGroup Label="Globals">
<ProjectGuid>{AC8F52F4-9FE6-4CEF-B549-8180757020C8}</ProjectGuid> <ProjectGuid>{AC8F52F4-9FE6-4CEF-B549-8180757020C8}</ProjectGuid>
<RootNamespace>BlitzPointer</RootNamespace> <RootNamespace>BlitzPointer</RootNamespace>
<WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -39,14 +40,14 @@
</ImportGroup> </ImportGroup>
<PropertyGroup Label="UserMacros" /> <PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<OutDir>$(SolutionDir)\#Build\$(ProjectName)\$(Configuration)\</OutDir> <OutDir>$(SolutionDir)#Build\$(ProjectName)\$(Configuration)\</OutDir>
<IntDir>$(SolutionDir)\#Intermediate\$(ProjectName)\$(Configuration)\</IntDir> <IntDir>$(SolutionDir)#Intermediate\$(ProjectName)\$(Configuration)\</IntDir>
<TargetExt>.dll</TargetExt> <TargetExt>.dll</TargetExt>
<LinkIncremental>true</LinkIncremental> <LinkIncremental>true</LinkIncremental>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<OutDir>$(SolutionDir)\#Build\$(ProjectName)\$(Configuration)\</OutDir> <OutDir>$(SolutionDir)#Build\$(ProjectName)\$(Configuration)\</OutDir>
<IntDir>$(SolutionDir)\#Intermediate\$(ProjectName)\$(Configuration)\</IntDir> <IntDir>$(SolutionDir)#Intermediate\$(ProjectName)\$(Configuration)\</IntDir>
<TargetExt>.dll</TargetExt> <TargetExt>.dll</TargetExt>
<LinkIncremental>false</LinkIncremental> <LinkIncremental>false</LinkIncremental>
</PropertyGroup> </PropertyGroup>
@@ -54,11 +55,9 @@
<ClCompile> <ClCompile>
<WarningLevel>Level3</WarningLevel> <WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization> <Optimization>Disabled</Optimization>
<SDLCheck>
</SDLCheck>
<AdditionalIncludeDirectories>$(ProjectDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> <AdditionalIncludeDirectories>$(ProjectDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<MultiProcessorCompilation>true</MultiProcessorCompilation> <MultiProcessorCompilation>true</MultiProcessorCompilation>
<BasicRuntimeChecks>Default</BasicRuntimeChecks> <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary> <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<BufferSecurityCheck>false</BufferSecurityCheck> <BufferSecurityCheck>false</BufferSecurityCheck>
<FunctionLevelLinking>true</FunctionLevelLinking> <FunctionLevelLinking>true</FunctionLevelLinking>
@@ -66,8 +65,8 @@
<CompileAsWinRT>false</CompileAsWinRT> <CompileAsWinRT>false</CompileAsWinRT>
<StructMemberAlignment>4Bytes</StructMemberAlignment> <StructMemberAlignment>4Bytes</StructMemberAlignment>
<EnableParallelCodeGeneration>true</EnableParallelCodeGeneration> <EnableParallelCodeGeneration>true</EnableParallelCodeGeneration>
<CreateHotpatchableImage>false</CreateHotpatchableImage> <CreateHotpatchableImage>true</CreateHotpatchableImage>
<RuntimeTypeInfo>false</RuntimeTypeInfo> <RuntimeTypeInfo>true</RuntimeTypeInfo>
<OpenMPSupport>false</OpenMPSupport> <OpenMPSupport>false</OpenMPSupport>
<ForcedIncludeFiles> <ForcedIncludeFiles>
</ForcedIncludeFiles> </ForcedIncludeFiles>
@@ -79,8 +78,8 @@
<IntrinsicFunctions>false</IntrinsicFunctions> <IntrinsicFunctions>false</IntrinsicFunctions>
<FavorSizeOrSpeed>Neither</FavorSizeOrSpeed> <FavorSizeOrSpeed>Neither</FavorSizeOrSpeed>
<StringPooling>true</StringPooling> <StringPooling>true</StringPooling>
<EnableEnhancedInstructionSet>NoExtensions</EnableEnhancedInstructionSet> <EnableEnhancedInstructionSet>NotSet</EnableEnhancedInstructionSet>
<FloatingPointExceptions>false</FloatingPointExceptions> <FloatingPointExceptions>true</FloatingPointExceptions>
<UseUnicodeForAssemblerListing>true</UseUnicodeForAssemblerListing> <UseUnicodeForAssemblerListing>true</UseUnicodeForAssemblerListing>
<PreprocessorDefinitions>%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>%(PreprocessorDefinitions)</PreprocessorDefinitions>
<DebugInformationFormat>EditAndContinue</DebugInformationFormat> <DebugInformationFormat>EditAndContinue</DebugInformationFormat>
@@ -102,10 +101,8 @@
<ClCompile> <ClCompile>
<WarningLevel>Level3</WarningLevel> <WarningLevel>Level3</WarningLevel>
<Optimization>Full</Optimization> <Optimization>Full</Optimization>
<FunctionLevelLinking>false</FunctionLevelLinking> <FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions> <IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>
</SDLCheck>
<AdditionalIncludeDirectories>$(ProjectDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> <AdditionalIncludeDirectories>$(ProjectDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<MultiProcessorCompilation>true</MultiProcessorCompilation> <MultiProcessorCompilation>true</MultiProcessorCompilation>
<FavorSizeOrSpeed>Speed</FavorSizeOrSpeed> <FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
@@ -122,14 +119,15 @@
</ForcedIncludeFiles> </ForcedIncludeFiles>
<BasicRuntimeChecks>Default</BasicRuntimeChecks> <BasicRuntimeChecks>Default</BasicRuntimeChecks>
<MinimalRebuild>false</MinimalRebuild> <MinimalRebuild>false</MinimalRebuild>
<InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion> <InlineFunctionExpansion>Default</InlineFunctionExpansion>
<OmitFramePointers>false</OmitFramePointers> <OmitFramePointers>false</OmitFramePointers>
<CallingConvention>Cdecl</CallingConvention> <CallingConvention>Cdecl</CallingConvention>
<StringPooling>true</StringPooling> <StringPooling>true</StringPooling>
<EnableEnhancedInstructionSet>NoExtensions</EnableEnhancedInstructionSet> <EnableEnhancedInstructionSet>NotSet</EnableEnhancedInstructionSet>
<FloatingPointExceptions>false</FloatingPointExceptions> <FloatingPointExceptions>true</FloatingPointExceptions>
<UseUnicodeForAssemblerListing>true</UseUnicodeForAssemblerListing> <UseUnicodeForAssemblerListing>true</UseUnicodeForAssemblerListing>
<PreprocessorDefinitions>%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>%(PreprocessorDefinitions)</PreprocessorDefinitions>
<DebugInformationFormat>None</DebugInformationFormat>
</ClCompile> </ClCompile>
<Link> <Link>
<GenerateDebugInformation>false</GenerateDebugInformation> <GenerateDebugInformation>false</GenerateDebugInformation>