- Timestamp:
- Nov 8, 2024 5:00:52 PM (3 months ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp
r106893 r106897 3139 3139 #elif defined(RT_ARCH_ARM64) 3140 3140 /* 3141 * Patch 64-bit ARM hosts. 3141 * Patch 64-bit ARM hosts. 3142 3142 * We can make this work, provided the target address doesn't use bits 63:48. 3143 3143 */ … … 3261 3261 #elif defined(RT_ARCH_ARM64) 3262 3262 /* 3263 * Patch 64-bit ARM hosts. 3264 * 3265 * Note! Blindly ASSUMES that the code is at least 20 bytes long, that x17 3263 * Patch 64-bit ARM hosts. 3264 * 3265 * Note! Blindly ASSUMES that the code is at least 20 bytes long, that x17 3266 3266 * isn't being used, and that there are no branch instructions. 3267 3267 * So, far we've only seen the typical long STP sequence. … … 3404 3404 * In the code we've been looking at, the 4th instruction is a CBZ, 3405 3405 * which means we can only use 16 bytes here to do the patching. 3406 * 3406 * 3407 3407 * w10-1709: 3408 3408 * 1800243a0: f94003ef ldr x15, [sp] ; The APC routine address. … … 3571 3571 * 1800244b0: 94011b76 bl 0x18006b288 <RtlQueryEnvironmentVariable+0x21d8> 3572 3572 * 1800244b4: b40000a0 cbz x0, 0x1800244c8 <KiUserExceptionDispatcher+0x38> 3573 * 3573 * 3574 3574 * What is loaded and checked at the beginning is a function poitner caller 3575 3575 * Wow64PrepareForException, which we can presume is NULL for a native 3576 3576 * arm64 process. 3577 * 3577 * 3578 3578 * The easiest thing to do would be to hijack the pointer. Unfortunately 3579 3579 * that differs too much from the others architectures, as the patching
Note:
See TracChangeset
for help on using the changeset viewer.