VirtualAlloc hooking reports anomaly about mhook HOT 6 CLOSED

I'll leave this issue open until we remove that message.

from mhook.

@simonides, could you please post your kernel32.dll version and winver output (cmd->winver->line with version info)?

I have tried to run mhook-test on Win10 and met no ANOMALY in log, but my byte-code of VirtualAlloc is different from yours one.

from mhook.

@Grivus Thank you for taking a look. The file version is 10.0.16299.15 . Date modified: 29.9.2017 15:42
kernel32.zip
Winver output: Version 1709 (OS Build 16299.125)

from mhook.

This is how it looks on Win7(Build 7601:SP1): https://pastebin.com/MVt16n2z
File version: 6.1.7601.23714
kernel32.zip

from mhook.

@simonides, ok, I think I figured it out.

The REX prefix consists of only four meaningful bits, and all that bits are zero in the opcode 0x40 - first part of the
00007FFEF0CADFE0 40 53 push rbx
command. So mhook think that while it is legal opcode there is no sense to write it, because it change nothing from assembler point of view.

But Windows has it's own rules, and like described here it want all instructions to be at least 2 bytes long to allow us insert some jump instead of it if needed. So Windows compilers insert empty REX into small-size commands to reach needed length.

So you can just ignore that message. I think we could remove it to not confuse users.

from mhook.

Thank you for clarifying!

from mhook.