Skip to content

Support changing ESP in hook code #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Support changing ESP in hook code #12

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
43f9c02
Support changing ESP in hook code
Metadorius Nov 2, 2025
770100a
Optimize swapping by replacing XCHG which does memory lock with MOVs
Metadorius Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion SyringeDebugger.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,19 @@ DWORD SyringeDebugger::HandleException(DEBUG_EVENT const& dbgEvent)
0xE8, INIT, INIT, INIT, INIT, // CALL ProcAddress
0x83, 0xC4, 0x08, // ADD ESP, 8
0x64, /* FS segment prefix*/ 0xA3, 0x14, 0x00, 0x00, 0x00, // MOV fs:0x14, EAX
0x9D, 0x61, // POPFD, POPAD
0x9D, // POPFD
// start POPAD replica
0x5F, // POP EDI
0x5E, // POP ESI
0x5D, // POP EBP
0x5B, // POP EBX (temporary storage for modified ESP)
0x8B, 0x44, 0x24, 0x0C, // MOV EAX, [ESP + 0xC] (restore EAX which is last in PUSHAD order)
0x89, 0x5C, 0x24, 0x0C, // MOV [ESP + 0xC], EBX (place ESP last)
0x5B, // POP EBX
0x5A, // POP EDX
0x59, // POP ECX
0x5C, // POP ESP (restore ESP last thus not corrupting the stack pointer before all POPs are done)
// end POPAD replica
0x64, /* FS segment prefix*/ 0x83, 0x3D, 0x14, 0x00, 0x00, 0x00, 0x00, // CMP DWORD PTR fs:0x14, 0
0x74, 0x07, // JE proceed
0x64, /* FS segment prefix*/ 0xFF, 0x25, 0x14, 0x00, 0x00, 0x00, // JMP DWORD PTR fs:0x14
Expand Down