Fix bootstrap DLL and hook injection under Wine without SetThreadContext EIP redirects

[NayiemW]

Fix bootstrap DLL and hook injection under Wine without SetThreadContext EIP redirects

Problem

When Syringe runs under Wine, including Wine-based setups on macOS, Linux, and Proton, DLL injection and hook installation can silently fail.

The debugger loop continues running and the log may report the expected number of hooks, but the target process actually runs without any of them installed.

In CnCNet’s Yuri’s Revenge setup using Ares, Phobos, and CnCNet-Spawner, this causes the game to exit before spawn.ini is read.

Root cause

Syringe previously redirected execution by modifying the debuggee thread’s Eip through SetThreadContext.

Wine’s WoW64 debug-event resume path does not reliably honor these Eip changes when redirecting execution to a distant, dynamically allocated address, such as the LoadLibrary bootstrap stub in pAlloc.

This failure is particularly misleading:

• SetThreadContext reports success.
• A subsequent GetThreadContext call reports the requested Eip.
• The thread nevertheless resumes from its original execution location.
• DLL loading, feature resolution, and hook installation therefore silently do not occur.

This behavior was reproduced independently using a minimal target executable and debugger outside this codebase. In that test, redirects performed through WriteProcessMemory were honored, while redirects performed through SetThreadContext(Eip = ...) were not.

Fix

Execution is now redirected by writing an actual relative JMP instruction at the CPU’s real resume address, rather than relying on a thread-context mutation.

For an INT3 breakpoint, the CPU resumes at breakpointAddress + 1, so the redirect is written there using WriteProcessMemory.

The implementation adds the following:

WriteRedirectJmp

Writes a five-byte relative JMP at the debuggee’s resume address, redirecting execution to the required bootstrap or continuation code.

DetermineOverwriteSize

Decodes complete instructions until enough bytes are available for a safe five-byte jump, avoiding partial instruction overwrites.

BuildEntryTrampoline

Creates a trampoline for returning to the executable entry point.

Because the entry point may contain instructions larger than the required jump, the trampoline:

1. determines how many complete instructions must be overwritten;
2. copies and rebuilds those instructions using the existing Zydis-based RebuildInstructions logic; and
3. jumps back to the first untouched instruction at the original entry point.

CreateCodeHooks

The existing hook-generation and installation logic has been extracted into a dedicated method.

Hook creation now runs directly after DLL loading and feature-flag resolution complete. Syringe no longer redirects execution back to pcEntryPoint and waits for another breakpoint before creating the hooks, since that flow depended on the same unreliable SetThreadContext redirection.

Additional corrections

The bootstrap stub’s embedded INT3 is no longer restored during the feature-flag loop.

That breakpoint was created directly inside the allocated bootstrap code and was never registered through SetBP. Attempting to restore it through the breakpoint map therefore used an invalid default entry and corrupted the bootstrap stub during subsequent iterations.

The --detach completion condition now checks bHooksCreated directly.

Previously, detachment also required a single-step exception because hook creation was detected after redirecting execution back to the entry point. Hook creation now happens synchronously, so that single-step event no longer occurs and is no longer required.

Platform impact

This removes Syringe’s dependency on Wine honoring SetThreadContext-based Eip redirects.

The replacement uses ordinary process-memory patching and relative jumps, which are also supported on native Windows. The changes are therefore not expected to alter native Windows behavior.

Testing

Tested end-to-end on macOS under Wine using Red Alert 2 / Yuri’s Revenge with:

• Ares
• Phobos
• CnCNet-Spawner
• approximately 2,750 installed hooks

With this change, the game successfully launches directly into a running match instead of exiting before spawn.ini is read.

This has not yet been tested on native Windows. However, the changes use the same WriteProcessMemory-based patching mechanism already used elsewhere by Syringe and should not affect Windows builds or native Windows injection behavior.

[github-actions]

Nightly build for this pull request:

• Syringe-Release-428e2a59093e8f30b5dfd52a04760be0088200f9.zip
• Syringe-Debug-428e2a59093e8f30b5dfd52a04760be0088200f9.zip
  These artifacts will expire in 90 days and will not be available for download after that time.

This comment is automatic and is meant to allow guests to get latest nightly builds for this pull request without registering. It is updated on every successful build.