CDetour crash on x64 due to copying relative address to trampoline

[bottiger1]

While porting TF2 extensions to x64, I noticed a hook that was working on x32 started crashing.

I noticed CDetour copied this instruction to the trampoline.

lea rax, [rip + 0xbecbb1]

Since the offset is based on the current program position, the destination obviously becomes invalid if it is moved.

I am not sure if anyone wants to fix this as it seems like a daunting task to detect relative addressing in every possible instruction.

But on the other hand due to x64, more functions like this may lose the normal function prologue that is guaranteed to be free of relative addressing, so it may become a frequent problem. Maybe there's another library besides udis that handles this problem?

[Mooshua]

How x64 detours will be tackled is still to be determined. The backend will probably be migrated to a library with better platform/disassembly support.

[bottiger1]

May I ask who is determining it?

There are many extensions that use CDetour so it might not be a good idea to port a bunch of extensions with a broken version of CDetour.

I also did a google search and it seems like some other hooking libraries can handle this but are all windows only.

stevemk14ebr/PolyHook_2_0#119

[Mooshua]

May I ask who is determining it?

Sure as heck not me, but some folks in the AMcord were looking into SafetyHook if I recall correctly.