'ghost exceptions' fix - spoof hit detection needs to occur based on the demon event's reported exception address, rather than wherever the instruction pointer happens to be at the time of the exception

This commit is contained in:
Ryan Fleury committed 2025-01-07 11:04:34 -08:00
1 parent c1a2023b15
commit e82041e5df
2 files changed
+8 -1

No files matched your search

+1 -1
View File
@@ -5331,7 +5331,7 @@ ctrl_thread__run(DMN_CtrlCtx *ctrl_ctx, CTRL_Msg *msg)
if(spoof_mode &&
dmn_handle_match(target_process.dmn_handle, event->process) &&
dmn_handle_match(target_thread.dmn_handle, event->thread) &&
spoof.new_ip_value == event->instruction_pointer)
spoof.new_ip_value == event->address)
{
hit_spoof = 1;
log_infof("hit_spoof\n");