how to calculate the correct size to copy into the trampoline

348 views Asked by At

I'm trying to hook functions in x64 bit windows I can hook the target function easily but the problem is in creating the trampoline I need to know a suitable size to copy from the original function to the trampoline and then coping the jmp instruction to the target

this is my patch bytes :

unsigned char patch_12_bytes[] = {
  0x48, 0xb8, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0xFF, 0xE0
}; 

I put the address of the target address in it and copy it to the end of the trampoline which will jump to the address of the hooked function + the copied bytes

but sometimes I get some errors like access violation as the instructions aren't correct so I need to know how to get the correct size to copy and the jump to the bytes after it

0

There are 0 answers