Skip to content

Conversation

@xorcus
Copy link

@xorcus xorcus commented Nov 2, 2024

detour_alloc_trampoline_allocate_new(pbTarget, pLo, pHi) was designed with the assumption that pbTarget is going to be between pLo and pHi. In our case, 32-bit cscript!mainCRTStartup was loaded at 0x34020, i.e. pbTarget was below pLo (which was fixed to 0x80000 in detour_2gb_below), and therefore:

  • detour_alloc_region_from_hi(pLo, pbTarget) did not do anything
  • detour_alloc_region_from_lo(pbTarget, pHi) allocated a 64 KiB block below pLo (in our case happened to be 0x70000) which was later discarded and NULL returned in detour_alloc_trampoline

The fix clamps pbTarget into [pLo, pHi] range.

detour_alloc_trampoline_allocate_new(pbTarget, pLo, pHi) was designed with the assumption that pbTarget is going to be between pLo and pHi. In our case, 32-bit cscript!mainCRTStartup was loaded at 0x34020, i.e. pbTarget was below pLo (which was fixed to 0x80000 in detour_2gb_below), and therefore:
- detour_alloc_region_from_hi(pLo, pbTarget) did not do anything
- detour_alloc_region_from_lo(pbTarget, pHi) allocated a 64 KiB block below pLo (in our case happened to be 0x70000) which was later discarded and NULL returned in detour_alloc_trampoline
The fix clamps pbTarget into [pLo, pHi] range.
@xorcus
Copy link
Author

xorcus commented Nov 2, 2024

@microsoft-github-policy-service agree company="Microsoft"

Mauler125 added a commit to Mauler125/r5sdk that referenced this pull request May 3, 2025
Upgrade to latest from main (detours/detours@ea6c4ae7f3f1b1772b8a7cda4199230b932f5a50), and merge PR microsoft/Detours#325
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants