Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[64bit] fix popfw and truncated address in conditional jump instructions #14

Merged
merged 4 commits into from
May 23, 2018

Conversation

Fonger
Copy link
Contributor

@Fonger Fonger commented May 7, 2018

This fix a critical translation error that conditional jump addresses get truncated.
udis86 should update the opcode definition file too ( see vmt/udis86#126 vmt/udis86#128 )

also, popfw is correctly resolved in 64bit mode now ( see vmt/udis86#101 )

It seems that vmt doesn't maintain udis86 anymore for years. We have to fix that ourself.

before patch

00007ff71c0b247b 41 81 f8 00 08 00 00           cmp r8d, 0x800
00007ff71c0b2482 75 18                          jnz 0x1c0b249c
00007ff71c0b2484 66 9c                          pushfw
00007ff71c0b2486 66 9d                          o16 invalid

after patch

00007ff71c0b247b 41 81 f8 00 08 00 00           cmp r8d, 0x800
00007ff71c0b2482 75 18                          jnz 0x7ff711c0b249c
00007ff71c0b2484 66 9c                          pushfw
00007ff71c0b2486 66 9d                          popfw

@Fonger Fonger changed the title fix operation mode in conditional jump fix truncated address in conditional jump instructions May 7, 2018
@Fonger Fonger changed the title fix truncated address in conditional jump instructions [64bit] fix popfw and truncated address in conditional jump instructions May 7, 2018
@Fonger Fonger changed the base branch from master to develop May 13, 2018 13:28
@justinstenning justinstenning merged commit b54f152 into justinstenning:develop May 23, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants