http://bugs.winehq.org/show_bug.cgi?id=60463 Bug ID: 60463 Summary: ARM64EC: re-exported (-import) functions start with a bare x64 jmp [rip+x], which x64 hook detectors flag as an inline hook Product: Wine Version: unspecified Hardware: aarch64 OS: Android Status: UNCONFIRMED Severity: normal Priority: P2 Component: tools Assignee: wine-bugs@list.winehq.org Reporter: tarikcaramanico@gmail.com Target Milestone: --- On ARM64EC, functions that a DLL re-exports from another DLL (-import in the .spec file; kernel32.spec has many) are exported as lld's x64 import thunk, a bare FF 25 00000000 (jmp *__imp_X(%rip)). x64 code that resolves such an export (GetProcAddress) sees a function that starts with a 6-byte indirect jump, and x64 hook detectors in games treat that start as an inline hook. On x86_64 Wine the same export starts with winebuild's hot-patch prolog instead. - winebuild, x86_64: the end of output_exports in tools/winebuild/spec32.c (lines 585-622 at 63f62f7cd696) emits for every -import entry eight nops, the label __wine_spec_imp_<name>, the hot-patch prolog 48 8D A4 24 00 00 00 00 and jmp *__imp_<name>(%rip); the export points at that thunk. - winebuild, ARM64EC: the start of the same function (lines 414-439) writes only .drectve directives -export:Name=Name,@ord, so the plain Name of an import is lld's x64 import thunk. - lld: importThunkX86[] = {0xff, 0x25, 0x00, 0x00, 0x00, 0x00} (lld/COFF/Chunks.h). Exports whose target is ARM64EC code get a fast-forward sequence (48 8B C4 48 89 58 20 55 5D E9 ...), as Microsoft's toolchain does; an import thunk gets none. How it shows: Age of Empires IV checks 63 Windows API functions at start-up. Under Proton 11 ARM64EC (GameNative, Android) with FEX, 27 of them were flagged, all in kernel32's .text, all starting with FF 25. Presenting the same jumps as 48 FF 25 (a test change in the emulator) made the check flag nothing. Possible fix (not tested): for ARM64EC -import entries, emit the same x86_64 thunk as on x86_64 and point the -export: directive at it (MR !11975, winebuild assembling ARM64EC output as x86_64, looks like the base for this). arm64x_check_call (dlls/ntdll/signal_arm64ec.c) follows a bare FF 25 so that ARM64EC callers skip the emulator; it would then need to skip the hot-patch prolog as well. Not checked: what Microsoft's own ARM64X kernel32 or link.exe produce for a re-exported import. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.