0

In the first example I only set a breakpoint on user32!CreateWindowExW

enter image description here

In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain

enter image description here

In the 3rd example I place a breakpoint on notepad!WinMain, wait for it to break, and then I place the breakpoint on user32!CreateWindowExW, and this time it shows the jump instruction.

enter image description here

I confirmed that it does indeed jump to that address by stepping through, and I confirmed that the jump isn't there in the first 2 examples by unassembling as well as stepping to the next instruction. The callstack is identical in all 3 scenarios.

It reproduces every time. This is Windows 7 btw Windbg x64 10.0

What is going on ?

3
  • what's mapped at this 0x6fff00340 address? This looks like some hooking and jmp trampoline Jul 5 at 19:14
  • @PawełŁukasik from !address: + 06fff0000 070000000 000010000 MEM_PRIVATE MEM_COMMIT PAGE_EXECUTE_READ <unknown> [dtrR............]. It's clearly some trampoline block allocated by the nvd3d9wrapx because it then injects the jump instruction to the trampoline but I do not know why windbg is behaving like that Jul 5 at 20:13
  • It's not a trampoline function exactly. What it jumps to is just a single rip-relative memory indirect jump to an address, the address is stored with it. This is an address of a procedure loc_7FEFA2C3E40 in nvd3d9wrapx that I haven't got the symbols for Jul 5 at 22:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.