[原创] 让Detours支持ARM64EC-编程技术-看雪安全社区

[原创] 让Detours支持ARM64EC

发表于: 2026-8-5 02:15 381

[原创] 让Detours支持ARM64EC

Ratin

2026-8-5 02:15

381

# 背景

我看过Detours、MinHook、MHook等API Hook库后，认为稳定、兼容的API Hook库之位仍有空缺，于是有了<a href="elink@426K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3X3g2e0L8r3W2E0c8r3g2@1L8%4g2J5M7H3`.`.">KNSoft.SlimDetours</a>，基于Detours改进而来，重要的稳定性、兼容性提升/修复在 [[原创]浅探内联挂钩的水有多深](https://bbs.kanxue.com/thread-282877.htm) 一文里有详细介绍，且我在持续维护。现在它虽然Star不多，但已被 <a href="elink@c09K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6$3j5h3I4A6L8X3g2@1i4K6u0r3c8i4S2H3L8r3!0J5k6i4u0b7j5i4c8U0K9r3g2J5">ExplorerPatcher</a> (33.5k⭐)、<a href="elink@226K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5j5h3#2W2L8Y4y4G2k6Y4c8%4j5i4u0W2i4K6u0r3N6$3W2F1k6r3S2S2N6$3D9`.">windhawk</a> (8.6k⭐)这样的项目使用，Release Notes也提到换用<a href="elink@9e8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3X3g2e0L8r3W2E0c8r3g2@1L8%4g2J5M7H3`.`.">SlimDetours</a>后为它们提高了稳定性。

目前这些API Hook库在ARM64系统中存在兼容问题，最显著的是x64构建的Hook模块挂钩系统COM函数后，执行时会崩溃，如 Detours Issue: <a href="elink@a24K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3V1k6p5k6i4c8G2N6i4u0K6i4K6u0r3K9i4y4K6N6h3g2K6i4K6u0r3x3U0V1J5">#292</a>、<a href="elink@313K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3V1k6p5k6i4c8G2N6i4u0K6i4K6u0r3K9i4y4K6N6h3g2K6i4K6u0r3x3K6f1#2">#355</a>。根因是这些从COM对象的虚表里获取的函数地址不是<a href="elink@84fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9g2)9J5x3$3k6S2M7%4c8Q4x3X3c8X3L8%4u0%4j5i4u0V1i4K6u0V1M7$3g2I4N6h3g2F1j5$3g2K6">FFS</a>入口，而直接是ARM64EC代码（ARM64指令），Hook模块按自身构建向其写入x64指令，执行时即引发 `STATUS_ILLEGAL_INSTRUCTION` 异常。

即使后来Detours加入了ARM64EC构建目标（<a href="elink@c3fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3V1k6p5k6i4c8G2N6i4u0K6i4K6u0r3M7s2g2D9L8q4)9J5c8U0x3K6z5l9`.`.">PR #338</a>）也并不能解决此问题，目前正在打开状态的 <a href="elink@a94K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3V1k6p5k6i4c8G2N6i4u0K6i4K6u0r3M7s2g2D9L8q4)9J5c8U0x3^5y4b7`.`.">PR #385</a> 也只是为x64构建拒绝这样的场景（用返回错误取代崩溃），ARM64EC构建仍不兼容。x64构建要兼容ARM64是难了，但ARM64EC本身就为了提供x64与ARM64指令的互操作性，理论上能成。我在我的<a href="elink@942K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3X3g2e0L8r3W2E0c8r3g2@1L8%4g2J5M7H3`.`.">KNSoft.SlimDetours</a>上实现了ARM64EC兼容，下文是随着实现一起写的完整技术文档内容（附库上文档链接：<a href="elink@e55K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3X3g2e0L8r3W2E0c8r3g2@1L8%4g2J5M7#2)9J5c8X3u0D9L8$3u0Q4x3V1k6E0j5h3W2F1i4K6u0r3c8r3!0U0M7#2)9J5c8W2c8W2j5$3S2i4K9h3E0A6i4K6u0r3d9h3#2H3L8r3g2E0k6h3&6@1i4K6t1#2x3U0m8m8f1V1@1$3y4p5g2o6i4K6t1#2x3U0m8o6L8$3#2H3j5i4c8A6j5X3W2D9K9i4c8&6i4K6u0r3f1V1g2m8c8p5#2q4i4K6u0W2P5X3S2Q4x3X3c8o6e0W2)9J5k6h3#2V1">实现ARM64EC兼容性</a>）。
 ![](upload/attach/202608/853701_NFNS8Y2GU6U6BZB.webp)
<hr>

# 实现ARM64EC兼容性

## ARM64EC兼容问题与其它库的兼容性

<a href="elink@4c4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3L8%4k6W2M7Y4k6A6k6i4M7`.">Windows on Arm (WoA)</a> 通过 <a href="elink@cacK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9b7`.`.">ARM64EC ABI</a> 实现了x64指令与ARM64指令的互操作性，使x64与ARM64EC进程可以同时加载这两种二进制模块：x64模块指令在模拟环境中运行，ARM64EC模块则用ARM64指令原生运行。

ARM64EC 提供 <a href="elink@ac3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9g2)9J5x3$3k6S2M7%4c8Q4x3X3c8X3L8%4u0%4j5i4u0V1i4K6u0V1M7$3g2I4N6h3g2F1j5$3g2K6">FFS</a> (快进序列，x64函数) 来兼容强依赖于体系结构的内联挂钩场景，但目标地址不经过 <a href="elink@c50K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9g2)9J5x3$3k6S2M7%4c8Q4x3X3c8X3L8%4u0%4j5i4u0V1i4K6u0V1M7$3g2I4N6h3g2F1j5$3g2K6">FFS</a> 直接指向ARM64EC代码时（如一些系统ARM64EC模块提供的COM接口虚表项），目前常见挂钩库在x64/ARM64EC构建下仍将目标指令当作x64处理，写入x64跳转并会在执行时触发 `STATUS_ILLEGAL_INSTRUCTION` 异常，见 Detours Issue: <a href="elink@851K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3V1k6p5k6i4c8G2N6i4u0K6i4K6u0r3K9i4y4K6N6h3g2K6i4K6u0r3x3U0V1J5">#292</a> <a href="elink@378K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3V1k6p5k6i4c8G2N6i4u0K6i4K6u0r3K9i4y4K6N6h3g2K6i4K6u0r3x3K6f1#2">#355</a>。

## SlimDetours的实现

完整实现参考 <a href="elink@910K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3X3g2e0L8r3W2E0c8r3g2@1L8%4g2J5M7#2)9J5c8Y4m8#2L8r3I4Q4x3V1j5K6x3l9`.`.">KNSoft.SlimDetours #30</a>，以下是其实现要点。

### 检测目标代码类型

<a href="elink@9f9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3N6$3W2F1x3K6u0Q4x3V1k6S2M7r3W2Q4x3V1k6%4K9h3&6F1N6q4)9J5c8X3&6X3i4K6u0V1N6$3W2F1L8Y4c8Q4x3X3c8J5N6r3I4A6M7$3g2U0j5$3!0V1k6b7`.`.">`RtlIsEcCode`</a>用于检测目标代码是否为ARM64仿真兼容：
- 虽然官方文档写它由 `kernel32.lib` 导入，但它实际实现位于 `ntdll.dll` 中的同名导出函数。
- 虽然在Windows SDK中它的声明被 `#if defined(_M_ARM64EC)` 守卫，但x64构建下的二进制仍可调用它，ARM64与x64 Win11中 `ntdll.dll` 均导出了此函数。
- 它的内部读取了 `PEB::EcCodeBitMap`，实现可参考 [KNSoft.NDK: [NT:RTL] Implement `_Inline_RtlIsEcCode`](<mark class="encrypted">942K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3V1k6w2e0W2y4G2k6Y4c8Q4x3X3g2z5c8p5E0Q4x3V1k6U0L8$3#2E0K9i4c8Q4x3V1k6V1x3K6q4V1x3K6p5H3x3K6b7%4x3o6b7H3k6e0g2X3y4r3f1$3z5h3p5%4y4r3f1@1z5r3t1%4x3h3j5@1j5X3f1K6x3K6u0U0x3K6y4T1i4K6t1&6i4@1f1K6i4K6R3H3i4K6R3J5</mark>
```C
__inline
BOOLEAN
NTAPI
_Inline_RtlIsEcCode(
    _In_ DWORD64 CodePointer)
{
    PCUCHAR EcCodeBitMap;
    DWORD64 PageIndex;
    UCHAR PageBitMask;

if (SharedUserData->NativeProcessorArchitecture != PROCESSOR_ARCHITECTURE_ARM64 ||
        CodePointer < (DWORD64)MM_LOWEST_USER_ADDRESS)
    {
        return FALSE;
    }
    EcCodeBitMap = (PCUCHAR)NtCurrentPeb()->EcCodeBitMap;
    if (EcCodeBitMap == NULL)
    {
        return FALSE;
    }

PageIndex = CodePointer >> PAGE_SHIFT;
    PageBitMask = (UCHAR)(1u << (PageIndex % CHAR_BIT));
    return BooleanFlagOn(EcCodeBitMap[PageIndex / CHAR_BIT], PageBitMask);
}
```

### 处理两种指令集

为使ARM64EC构建同时处理x64与ARM64代码：
- 指令处理函数默认与编译目标平台匹配；处理ARM64指令的函数增加 `_arm64` 后缀，如`detour_skip_jmp_arm64`、`detour_copy_instruction_arm64`、`detour_gen_jmp_immediate_arm64`等，并在ARM64EC构建下参与编译。
- 增加 `detour_skip_jmp_arm64ec`，按目标代码类型选择 `detour_skip_jmp` 或`detour_skip_jmp_arm64`。
- `SlimDetoursCopyInstruction` 与 `SlimDetoursCodeFromPointer` 则在事务外自行检测代码类型。

### Trampoline的兼容

ARM64EC构建下，Trampoline要同时兼容x64和ARM64EC架构：
- ARM64EC Trampoline由`NtAllocateVirtualMemoryEx`带`MEM_EXTENDED_PARAMETER_EC_CODE`参数分配，x64 Trampoline沿用普通可执行内存。
- 目标补丁与Trampoline的跳回代码按代码类型生成：ARM64EC目标使用ARM64间接跳转，x64目标沿用x64跳转序列。

### x64构建为何无法为ARM64EC目标函数生成通用的转接桥？

x64 Hook模块挂钩ARM64EC目标时，调用链需要两次ABI转换：
- ARM64EC目标跳转到x64 Detour，需要Exit Thunk。
- x64 Detour通过Trampoline调用原函数，需要Entry Thunk。

<a href="elink@3baK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9g2)9J5x3$3g2F1N6s2u0&6i4K6u0V1j5h3&6V1i4K6u0V1k6i4S2A6N6q4)9J5k6s2c8Z5N6h3&6C8M7H3`.`.">Entry/Exit Thunks</a>的参数与返回值转换取决于函数签名；x64编译器不会生成ARM64EC Thunk，我们也无法仅凭函数地址生成它们。

ARM64EC Hook模块挂钩x64目标时同样存在两次ABI转换，但签名来自Hook代码：编译器根据ARM64EC Detour的签名生成Entry Thunk，并在通过有类型的原函数指针调用x64 Trampoline时生成Exit Thunk。挂钩ARM64EC目标时，目标、Detour与Trampoline均使用ARM64EC ABI，无需转换。

故x64构建Hook前要检测原始和解析后的目标地址，遇到ARM64EC代码即返回`HRESULT_FROM_NT(STATUS_NOT_SUPPORTED)`。挂钩此类目标应使用ARM64EC构建的Hook模块。若Windows未来使这些目标入口指向 <a href="elink@278K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9g2)9J5x3$3k6S2M7%4c8Q4x3X3c8X3L8%4u0%4j5i4u0V1i4K6u0V1M7$3g2I4N6h3g2F1j5$3g2K6">FFS</a>，x64 Hook模块才能更好地兼容这类目标。

## 兼容性验证

以下组合均使用[COMHook](../../../Source/Demo/COMHook.c)测试逻辑在ARM64真机上挂钩`IStream::Read`。进程架构由EXE决定，Hook模块架构单独列出。

| 进程 | Hook模块 | 目标代码 | Microsoft Detours | SlimDetours |
| --- | --- | --- | --- | --- |
| x64 | x64 | ARM64EC | **崩溃**（`STATUS_ILLEGAL_INSTRUCTION`） | **报错**（`STATUS_NOT_SUPPORTED`） |
| x64 | ARM64EC | ARM64EC | **崩溃**（`STATUS_ILLEGAL_INSTRUCTION`） | 通过 |
| ARM64EC | x64 | ARM64EC | **崩溃**（`STATUS_ILLEGAL_INSTRUCTION`） | **报错**（`STATUS_NOT_SUPPORTED`） |
| ARM64EC | ARM64EC | ARM64EC | **崩溃**（`STATUS_ILLEGAL_INSTRUCTION`） | 通过 |

## 参考资料

- <a href="elink@22cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1i4K6u0V1N6i4y4Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0r3j5i4u0E0i4K6u0r3j5i4u0E0y4U0c8W2j5#2)9J5k6r3q4T1K9b7`.`.">Understanding Arm64EC ABI and assembly code</a>

本作品采用 <a href="elink@9d6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4J5k6h3q4@1K9i4k6W2j5$3!0E0L8h3!0F1M7#2)9J5k6h3!0J5k6#2)9J5c8X3I4A6j5$3g2F1M7$3g2K6i4K6u0r3j5Y4W2Q4x3X3c8F1j5#2)9J5k6s2y4S2i4K6u0r3y4q4)9J5k6e0m8Q4x3V1j5`.">知识共享署名-非商业性使用-相同方式共享 4.0 国际许可协议 (CC BY-NC-SA 4.0)</a> 进行许可。  
<br>
**<a href="elink@903K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6d9j5i4c8A6L8V1y4z5">Ratin</a> &lt;[ratin@knsoft.org](mailto:ratin@knsoft.org)&gt;**  
*中国国家认证系统架构设计师*  
*<a href="elink@e31K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5k6h3q4U0N6r3!0K6i4K6u0r3M7X3g2S2j5%4c8G2M7H3`.`.">ReactOS</a>贡献者*

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

收藏・2

点赞・3

打赏