Uwe Bonnes bon@elektron.ikp.physik.tu-darmstadt.de writes:
However I like to ask if there are other methods of distinguishing DATA and function references? Could the PE loader perhaps know? Or can we perhaps protect our snoop entries from being read as data and catch those exceptions? Any other idea?
I don't think there's any way to make snoop 100% reliable, the PE file simply doesn't contain enough information. This is the reason we have to build special tables in the builtin dlls for relay debugging.