macos m1 pthread_create hook之后崩溃,替换的跳转指令超出函数本身指令大小
nanatuo opened this issue · comments
nanatuo commented
在macos m1 pthread_create 指令中只有两条8字节,而dobbyhook arm64架构替换指令需要三条指令12字节,替换后导致和pthread_create相邻的指令被破坏,相邻函数被调用时错误的指令导致崩溃
nanatuo commented
针对m1 崩溃可以选择去hook pthread_create 内部的核心函数 __bsdthread_create
pthread_create:
https://github.com/apple/darwin-libpthread/blob/2b46cbcc56ba33791296cd9714b2c90dae185ec7/src/pthread.c#L1481
__bsdthread_create:
https://github.com/apple/darwin-libpthread/blob/2b46cbcc56ba33791296cd9714b2c90dae185ec7/src/pthread.c#L1460
jmpews(AKA.zz) commented
try the trick function "dobby_enable_near_branch_trampoline()", only need 4 bytes for arm64(e) arch.