Breaking on unsupported RIP-addressing?

[Convery]

mhook/mhook-lib/mhook.cpp

Lines 1004 to 1013 in 2238938

	else if ( (pins->OperandCount >= 1) && (pins->Operands[0].Flags & OP_IPREL) )
	{
	// unsupported rip-addressing
	ODPRINTF((L"mhooks: DisassembleAndSkip: found unsupported OP_IPREL on operand %d", 0));
	// dump instruction bytes to the debug output
	for (DWORD i=0; i<pins->Length; i++)
	{
	ODPRINTF((L"mhooks: DisassembleAndSkip: instr byte %2.2d: 0x%2.2x", i, pLoc[i]));
	}
	break;

In this, and the following two cases, the break can (and does in my tests) cause the hook installation to fail. I have personally removed them on my end and it works well. But what's the reasoning for breaking here?

[SergiusTheBest]

What API are you trying to hook? Can you post its prologue from disasm?

[Convery]

Looks like this and fails with found unsupported OP_IPREL on operand 1 on 0000000063812C84.

0000000063812C80  sub         rsp,28h  
0000000063812C84  mov         r9d,dword ptr [6382A770h]  
0000000063812C8B  test        r9d,r9d  
0000000063812C8E  je          0000000063812CA1  
0000000063812C90  xor         edx,edx  
0000000063812C92  mov         ecx,r9d  
0000000063812C95  call        00000000638126C0  

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[razuit]

In case it helps anyone: DeleteFileW on Windows 11 21H2 experiences this issue as well:

mhooks: DisassembleAndSkip: found unsupported OP_IPREL on operand 0
mhooks: DisassembleAndSkip: instr byte 00: 0xe8
mhooks: DisassembleAndSkip: instr byte 01: 0x2f
mhooks: DisassembleAndSkip: instr byte 02: 0x00
mhooks: DisassembleAndSkip: instr byte 03: 0x00
mhooks: DisassembleAndSkip: instr byte 04: 0x00

Here is the disassembly of DeleteFileW (mhook breaks on second line):

KERNELBASE!DeleteFileW:
00007ffb`0dada600 4883ec28        sub     rsp,28h
00007ffb`0dada604 e82f000000      call    KERNELBASE!InternalDeleteFileW (00007ffb`0dada638)

[SergiusTheBest]

@razuit Thanks!