'ghost exceptions' fix - spoof hit detection needs to occur based on the demon event's reported exception address, rather than wherever the instruction pointer happens to be at the time of the exception

This commit is contained in:
Ryan Fleury
2025-01-07 11:04:34 -08:00
parent c1a2023b15
commit e82041e5df
2 changed files with 8 additions and 1 deletions
+1 -1
View File
@@ -5331,7 +5331,7 @@ ctrl_thread__run(DMN_CtrlCtx *ctrl_ctx, CTRL_Msg *msg)
if(spoof_mode &&
dmn_handle_match(target_process.dmn_handle, event->process) &&
dmn_handle_match(target_thread.dmn_handle, event->thread) &&
spoof.new_ip_value == event->instruction_pointer)
spoof.new_ip_value == event->address)
{
hit_spoof = 1;
log_infof("hit_spoof\n");