1

In the first example I only set a breakpoint on user32!CreateWindowExW

enter image description here

In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain

enter image description here

In the 3rd example I place a breakpoint on notepad!WinMain, wait for it to break, and then I place the breakpoint on user32!CreateWindowExW, and this time it shows the jump instruction.

enter image description here

I confirmed that it does indeed jump to that address by stepping through, and I confirmed that the jump isn't there in the first 2 examples by unassembling as well as stepping to the next instruction. The callstack is identical in all 3 scenarios.

It reproduces every time. This is Windows 7 btw Windbg x64 10.0

What is going on ?

3
  • what's mapped at this 0x6fff00340 address? This looks like some hooking and jmp trampoline Commented Jul 5, 2022 at 19:14
  • @PawełŁukasik from !address: + 06fff0000 070000000 000010000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READ <unknown> [dtrR............]. It's clearly some trampoline block allocated by the nvd3d9wrapx because it then injects the jump instruction to the trampoline but I do not know why windbg is behaving like that Commented Jul 5, 2022 at 20:13
  • It's not a trampoline function exactly. What it jumps to is just a single rip-relative memory indirect jump to an address, the address is stored with it. This is an address of a procedure loc_7FEFA2C3E40 in nvd3d9wrapx that I haven't got the symbols for Commented Jul 5, 2022 at 22:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.