Skip to content

Tags: frida/frida-gum

Tags

17.9.7

Toggle 17.9.7's commit message

Unverified

This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
stalker-x86: Skip AVX2 ymm save on Win7 WoW64

On Windows 7 (NT 6.1) in a 32-bit (WoW64) process, the AVX2
ymm save/restore (vextracti128/vinserti128) emitted into
Stalker's prolog/epilog from a JIT RWX page corrupts wow64cpu
state. TEB64 fields get zeroed (NtTib.Self at +0x30, PEB at
+0x60, Win32ThreadInfo at +0x78, TlsSlots[0] /
WOW64_TLS_STACKPTR64 at +0x1480), so the next wow64 syscall
faults inside wow64cpu!CpupReturnFromSimulatedCode reading
`mov rsp, [r12+0x1480]` as zero.

Wow64cpu-specific to NT 6.1: Win7 32-bit native, Win10/11
WoW64, and 64-bit processes are unaffected. fxsave already
preserves the lower 128 bits of YMM, and the Windows x86 ABI
does not preserve YMM upper halves across calls, so omitting
the save is safe (I think).

17.9.6

Toggle 17.9.6's commit message
interceptor: Fix shared deflector on arm64e

The dispatcher thunk pointer wasn't signed.

17.9.5

Toggle 17.9.5's commit message
interceptor: Fix shared deflector on arm64e

The dispatcher thunk pointer wasn't signed.

17.9.4

Toggle 17.9.4's commit message
interceptor: Fix shared deflector on arm64e

The dispatcher thunk pointer wasn't signed.

17.9.3

Toggle 17.9.3's commit message
subprojects: Bump outdated

17.9.2

Toggle 17.9.2's commit message
submodules: Bump releng

17.9.1

Toggle 17.9.1's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Add tool to package devkits as XCFrameworks (#1101)

17.9.0

Toggle 17.9.0's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Add tool to package devkits as XCFrameworks (#1101)

17.8.3

Toggle 17.8.3's commit message
ci: Bump Android NDK to r29

17.8.2

Toggle 17.8.2's commit message
ci: Bump Android NDK to r29