Uh oh!
There was an error while loading. Please reload this page.
Deny instrumentation of arm64 native code by x86 and x64 detours. - #385
Deny instrumentation of arm64 native code by x86 and x64 detours.#385Andrey Shedel (ashedel) wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.
Adds a guard in DetourAttachEx to prevent x86/x64 detours from patching ARM64EC/native targets on ARM64 Windows (EC emulation scenario), avoiding illegal-instruction crashes.
Changes:
- Introduces ARM64EC/ARM64 detection helpers for x86/x64 builds.
- Blocks DetourAttachEx when the target pointer is determined to be ARM64EC/ARM64 and returns an error.
- Minor formatting cleanup in ARM64 indirect jump generation code.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
| static PFN_RtlIsEcCode pfnRtlIsEcCode = NULL; | ||
| static BOOL s_fInitialized = FALSE; | ||
| if (!s_fInitialized) { | ||
| s_fInitialized = TRUE; | ||
| typedef BOOL (WINAPI *PFN_IsWow64Process2)(HANDLE, USHORT*, USHORT*); | ||
| HMODULE hKernel32 = GetModuleHandleW(L"kernel32.dll"); |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
| static BOOL s_fInitialized = FALSE; | ||
| if (!s_fInitialized) { | ||
| s_fInitialized = TRUE; |
There was a problem hiding this comment.
Why you do not set this at the end of the block? Because two initializations can happen in parallel? If so, is it not better to use serialized read instructions?
| typedef BOOL (WINAPI *PFN_IsWow64Process2)(HANDLE, USHORT*, USHORT*); | ||
| HMODULE hKernel32 = GetModuleHandleW(L"kernel32.dll"); | ||
| if (hKernel32) { |
There was a problem hiding this comment.
They do not use (hKernel32 != NULL) in this repro? :-)
mirh
commented
Jul 22, 2026
Excuse me, this PR makes a lot of sense and all. |
Charles Milette (sylveon)
commented
Jul 22, 2026
Would make more sense to me to enlighten Detours to write the proper ARM64 code for a redirect, but I don't know what that involves exactly. |
Ratin Gao (RatinCN)
commented
Aug 1, 2026
mirhCharles Milette (@sylveon) and others interested in ARM64EC compatibility, I have implemented ARM64EC compatibility in KNSoft#30. When the hook DLL is built for ARM64EC, it can correctly hook both x64 and ARM64EC target functions in x64 and ARM64EC processes on ARM64 systems. Only some documentation updates remain. I will finish it asap. |
Ratin Gao (RatinCN)
commented
Aug 4, 2026
Done, I've fixed this in my KNSoft.SlimDetours. |
mirh
commented
Aug 4, 2026
Thank you so much for even detailing that thing I wanted to ask you, about why a x64 dll could not force emit an arm64 jmp. I'm looking forward to your port, which is going to be precious for a lot of game mods. |
Ratin Gao (RatinCN)
commented
Aug 5, 2026
Done. #388 |
Andrey Shedel (ashedel)
commented
Aug 5, 2026
Thank you! Will look into it asap. |
This change adds the logic to deny writing over the native arm64 code when running x64/x86 detours in EC emulation mode.