Ruptura Progress Report - February 2024

[alexrp]

This is part of a series of progress reports that are posted with a monthly-ish cadence when there's notable progress made on the project.

v2.1.7 Release

v2.1.7 was a feature release that enhanced Vezel.Ruptura.Injection to work when running under Wine. In particular:

• PeNet is unable to resolve exports in loaded PE images under Wine. This is probably something that should be fixed in PeNet eventually, but in the meantime, we will fall back to resolving kernel32.dll exports in the current process. Both Windows and Wine load 'special' system libraries (like ntdll.dll and kernel32.dll) at the same address in all processes, making this safe (even though it is technically an undocumented implementation detail).
• Wine appears to be stricter than Windows when it comes to process access rights. We used to be able to get away with PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, but under Wine, we also need PROCESS_CREATE_THREAD (for CreateRemoteThread) and PROCESS_QUERY_LIMITED_INFORMATION (for IsWow64Process2).

With these changes, all samples now work under Wine (though with some minor edits due to conhost.exe not working like the Windows version).

Additionally, Vezel.Ruptura.Hosting was changed to generate the entry point type as static partial class Program. This allows users to extend the type if necessary, e.g. to provide a BuildAvaloniaApp() method for Avalonia.

Future Plans

We decided to pursue a different approach to adding 32-bit support (which has been blocked for a while due to a Zig bug). As a result, the theme of v3.0 has changed to being about improvements to the injection and hosting story:

• Support for 32-bit processes #5
• Sanitize error codes returned from the native module #11
• Support injecting NativeAOT-compiled DLLs (.NET 8) #13
• Migrate away from libnethost.lib #98

v4.0 has also changed accordingly:

• Implement more space-efficient code managers #28
• Add a VirtualFunctionTableHook class in Vezel.Ruptura.Memory #31
• Support chasing unconditional jumps in FunctionHook #33
• FunctionHook should support using an absolute jump patch if the user requests it #34
• Add a CodeHook class for mid-function hooking #52
• Switch minimum TFM to net10.0 #102