LH incorrectly hooks DLLs that transition into ARM64 #8
Description
Use case: Running WinARM (from MAC using Parallels for example, or a native MSFT ARM based notebook)
Module = KERNELBASE.sys
Function = CreateFileW
pseudo code: HMODULE mod=(HMODULE)LoadLibraryA("kernelbase.sys")
void * origPtr = GetProcAddress("CreateFileW")
... use LH to "hook" and make a call to anything that gets to CreateFileW (fopen is fine, or use CreateFileW)
calling the ORIGINAL hook will crash/fault... along the lines of:
typedef HANDLE (*pfnCFW)( ...the..args...to...CFW);
HANDLE myCreateFileW( ..args ..)
{
pfnCFW orig = (pfwCFW)LH.trampoline;
return orig( .. args ..); <-- CRASH
}