Tags: frida/frida-gum
Tags
stalker-x86: Skip AVX2 ymm save on Win7 WoW64 On Windows 7 (NT 6.1) in a 32-bit (WoW64) process, the AVX2 ymm save/restore (vextracti128/vinserti128) emitted into Stalker's prolog/epilog from a JIT RWX page corrupts wow64cpu state. TEB64 fields get zeroed (NtTib.Self at +0x30, PEB at +0x60, Win32ThreadInfo at +0x78, TlsSlots[0] / WOW64_TLS_STACKPTR64 at +0x1480), so the next wow64 syscall faults inside wow64cpu!CpupReturnFromSimulatedCode reading `mov rsp, [r12+0x1480]` as zero. Wow64cpu-specific to NT 6.1: Win7 32-bit native, Win10/11 WoW64, and 64-bit processes are unaffected. fxsave already preserves the lower 128 bits of YMM, and the Windows x86 ABI does not preserve YMM upper halves across calls, so omitting the save is safe (I think).
PreviousNext