Ruptura Progress Report - March 2023

[alexrp]

This is the first in a new series of progress reports. These will be posted with a monthly-ish cadence when there's notable progress made on the project.

v1.0.2 Release

The first stable version of Ruptura, v1.0.2, was released several months ago. This release partially fulfilled the goal of creating a spiritual successor to EasyHook - the only major missing feature being support for 32-bit processes.

CoreCLR Regression

Our recent .NET SDK upgrades seem to have an uncovered a CoreCLR regression:

• Intermittent CoreCLR assertion failures in samples #56

This is likely going to be a major blocker for v2.0.

Future Plans

There's plenty of work to be done for v2.0. I would consider these issues to be the highlights:

• Add a VirtualFunctionTableHook class in Vezel.Ruptura.Memory #31
• Support chasing unconditional jumps in FunctionHook #33
• FunctionHook should support using an absolute jump patch if the user requests it #34
• Add a CodeHook class for mid-function hooking #52

Additionally, the following high-priority issues will need to be addressed:

• Support for 32-bit processes #5
• Revise FunctionHook API to require function prototype information (.NET 9+) #39

These are currently slated for v3.0 but will be tackled as soon as they're unblocked.