From 03d7651916304e35a7f47027e7f1b58f618ed05d Mon Sep 17 00:00:00 2001
From: vaxerski <43317083+vaxerski@users.noreply.github.com>
Date: Mon, 27 Feb 2023 19:17:58 +0000
Subject: Plugin Hooks: fix original bytes on %rip accesses

---
 src/plugins/HookSystem.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'src/plugins/HookSystem.cpp')

diff --git a/src/plugins/HookSystem.cpp b/src/plugins/HookSystem.cpp
index 71789d46..ce53d653 100644
--- a/src/plugins/HookSystem.cpp
+++ b/src/plugins/HookSystem.cpp
@@ -99,6 +99,9 @@ bool CFunctionHook::hook() {
     const auto TRAMPOLINE_SIZE = sizeof(ABSOLUTE_JMP_ADDRESS) + HOOKSIZE + sizeof(PUSH_RAX) + m_vTrampolineRIPUses.size() * (sizeof(CALL_WITH_RAX) - 6);
     m_pTrampolineAddr          = mmap(NULL, TRAMPOLINE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 
+    m_pOriginalBytes = malloc(HOOKSIZE);
+    memcpy(m_pOriginalBytes, m_pSource, HOOKSIZE);
+
     // populate trampoline
     memcpy(m_pTrampolineAddr, m_pSource, HOOKSIZE);                                                              // first, original func bytes
     memcpy(m_pTrampolineAddr + HOOKSIZE, PUSH_RAX, sizeof(PUSH_RAX));                                            // then, pushq %rax
@@ -156,7 +159,7 @@ bool CFunctionHook::unhook() {
     mprotect(m_pSource - ((uint64_t)m_pSource) % sysconf(_SC_PAGE_SIZE), sysconf(_SC_PAGE_SIZE), PROT_READ | PROT_WRITE | PROT_EXEC);
 
     // write back original bytes
-    memcpy(m_pSource, m_pTrampolineAddr, m_iHookLen);
+    memcpy(m_pSource, m_pOriginalBytes, m_iHookLen);
 
     // revert mprot
     mprotect(m_pSource - ((uint64_t)m_pSource) % sysconf(_SC_PAGE_SIZE), sysconf(_SC_PAGE_SIZE), PROT_READ | PROT_EXEC);
@@ -169,6 +172,9 @@ bool CFunctionHook::unhook() {
     m_iHookLen        = 0;
     m_iTrampoLen      = 0;
     m_pTrampolineAddr = nullptr;
+    m_pOriginalBytes  = nullptr;
+
+    free(m_pOriginalBytes);
 
     return true;
 }
-- 
cgit v1.2.3