Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible problem with 64 bit code (find_ref_loc fucntion)? #87

Open
govcert-ch opened this issue Feb 26, 2020 · 0 comments
Open

Possible problem with 64 bit code (find_ref_loc fucntion)? #87

govcert-ch opened this issue Feb 26, 2020 · 0 comments
Assignees

Comments

@govcert-ch
Copy link

govcert-ch commented Feb 26, 2020

I'd also like to create flirt libraries for Go code (64 bit) - however, in first tests, only around 30% matched. I'm not sure where the problem exactly is, but it could be here:

    ...
    if isCode(getFlags(ea)):
        for i in zrange(ea, max(ea, 1 + get_item_end(ea) - config.pointer_size)):
            if get_long(i) == ref:
                return i

That code should find outgoing data or code references so they can be excluded from CRC32 checksums and signature and assumes these to be 32- or 64-bit values depending or architecture, not really sure about it... but it seems to fail with 64-bit instructions like

48 8B 05 F6 FF A3 00                    mov     rax, cs:main_something

as this is a 32-bit relative offset (0xa3fff6) in 64 bit code. Actually I think all references in 64 bit code is 32 bit relative... In these cases, nothing is put into variable_bytes and the offset is added to crc32, which it probably should not - if I understand the code correctly.

Another small thing I find odd is

    # this will be either " :%04d %s" or " :%08d %s"
    public_format = " :%%0%dX %%s" % (config.pointer_size)

Shouldn't this be config.pointer_size*2 as each character only covers one nibble, so each byte requires 2 characters? Or is this a specific feature of Ida that these values only cover half the bitsize?

@govcert-ch govcert-ch changed the title Possible problem with 64 bit code (find_ref_log fucntion)? Possible problem with 64 bit code (find_ref_loc fucntion)? Feb 27, 2020
@williballenthin williballenthin self-assigned this Feb 27, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants