[Bug 60463] New: ARM64EC: re-exported (-import) functions start with a bare x64 jmp [rip+x], which x64 hook detectors flag as an inline hook

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60463

            Bug ID: 60463
           Summary: ARM64EC: re-exported (-import) functions start with a
                    bare x64 jmp [rip+x], which x64 hook detectors flag as
                    an inline hook
           Product: Wine
           Version: unspecified
          Hardware: aarch64
                OS: Android
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: tools
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---

On ARM64EC, functions that a DLL re-exports from another DLL (-import in the
.spec file; kernel32.spec has many) are exported as lld's x64 import thunk, a
bare FF 25 00000000 (jmp *__imp_X(%rip)). x64 code that resolves such an export
(GetProcAddress) sees a function that starts with a 6-byte indirect jump, and
x64 hook detectors in games treat that start as an inline hook. On x86_64 Wine
the same export starts with winebuild's hot-patch prolog instead.

- winebuild, x86_64: the end of output_exports in tools/winebuild/spec32.c
(lines 585-622 at 63f62f7cd696) emits for every -import entry eight nops, the
label __wine_spec_imp_<name>, the hot-patch prolog 48 8D A4 24 00 00 00 00 and
jmp *__imp_<name>(%rip); the export points at that thunk.
- winebuild, ARM64EC: the start of the same function (lines 414-439) writes
only .drectve directives -export:Name=Name,@ord, so the plain Name of an import
is lld's x64 import thunk.
- lld: importThunkX86[] = {0xff, 0x25, 0x00, 0x00, 0x00, 0x00}
(lld/COFF/Chunks.h). Exports whose target is ARM64EC code get a fast-forward
sequence (48 8B C4 48 89 58 20 55 5D E9 ...), as Microsoft's toolchain does; an
import thunk gets none.

How it shows: Age of Empires IV checks 63 Windows API functions at start-up.
Under Proton 11 ARM64EC (GameNative, Android) with FEX, 27 of them were
flagged, all in kernel32's .text, all starting with FF 25. Presenting the same
jumps as 48 FF 25 (a test change in the emulator) made the check flag nothing.

Possible fix (not tested): for ARM64EC -import entries, emit the same x86_64
thunk as on x86_64 and point the -export: directive at it (MR !11975, winebuild
assembling ARM64EC output as x86_64, looks like the base for this).
arm64x_check_call (dlls/ntdll/signal_arm64ec.c) follows a bare FF 25 so that
ARM64EC callers skip the emulator; it would then need to skip the hot-patch
prolog as well.

Not checked: what Microsoft's own ARM64X kernel32 or link.exe produce for a
re-exported import.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.