diff --git a/libIRDB/test/check_thunks.cpp b/libIRDB/test/check_thunks.cpp
index 2101ce7273e93f1ddbacd08bc855a9cf8de4147a..22c22b63fcb897e47e5bdab5368a3809a0fda957 100644
--- a/libIRDB/test/check_thunks.cpp
+++ b/libIRDB/test/check_thunks.cpp
@@ -71,9 +71,9 @@ void check_for_thunk_offsets(FileIR_t* firp, virtual_offset_t thunk_base)
continue;
// string add_offset=string(d.Argument2.ArgMnemonic);
- const auto add_offset=d.getOperand(1).getString();
+ //const auto add_offset=d.getOperand(1).getString();
- virtual_offset_t addoff=strtol(add_offset.c_str(),NULL,16);
+ virtual_offset_t addoff=d.getOperand(1).getConstant(); //strtol(add_offset.c_str(),NULL,16);
/* bounds check gently */
if(0<addoff && addoff<100)
@@ -89,7 +89,7 @@ void check_for_thunk_offsets(FileIR_t* firp, virtual_offset_t thunk_base)
/* no indexing please! */
// if(d.Argument2.Memory.IndexRegister!=0)
- if(!d.getOperand(1).hasIndexRegister())
+ if(d.getOperand(1).hasIndexRegister())
continue;
// virtual_offset_t leaoff=d.Argument2.Memory.Displacement;
@@ -107,11 +107,10 @@ void check_for_thunk_offsets(FileIR_t* firp, virtual_offset_t thunk_base)
}
}
-void check_for_thunk_offsets(FileIR_t* firp, Instruction_t *thunk_insn, string reg, string offset)
+void check_for_thunk_offsets(FileIR_t* firp, Instruction_t *thunk_insn, string reg, uint64_t offset)
{
- virtual_offset_t thunk_base=thunk_insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+
- strtol(offset.c_str(),NULL,16);
+ virtual_offset_t thunk_base=thunk_insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+offset;
//virtual_offset_t thunk_call_addr=thunk_insn->GetAddress()->GetVirtualOffset();
//virtual_offset_t thunk_call_offset=strtol(offset.c_str(),NULL,16);
@@ -129,13 +128,12 @@ void check_for_thunk_offsets(FileIR_t* firp, Instruction_t *thunk_insn, string r
* check the rest of the function for offsets that might help form a code pointer.
*/
void check_func_for_thunk_offsets(Function_t *func, Instruction_t* thunk_insn,
- string reg, string offset)
+ string reg, uint64_t offset)
{
- virtual_offset_t thunk_base=thunk_insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+
- strtol(offset.c_str(),NULL,16);
+ virtual_offset_t thunk_base=thunk_insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+offset;
//virtual_offset_t thunk_call_addr=thunk_insn->GetAddress()->GetVirtualOffset();
//virtual_offset_t thunk_call_offset=strtol(offset.c_str(),NULL,16);
@@ -165,9 +163,9 @@ void check_func_for_thunk_offsets(Function_t *func, Instruction_t* thunk_insn,
continue;
// string add_offset=string(d.Argument2.ArgMnemonic);
- const auto add_offset=d.getOperand(1).getString();
+ // const auto add_offset=d.getOperand(1).getString();
- virtual_offset_t addoff=strtol(add_offset.c_str(),NULL,16);
+ virtual_offset_t addoff=d.getOperand(1).getConstant(); //strtol(add_offset.c_str(),NULL,16);
/* bounds check gently */
if(0<addoff && addoff<100)
@@ -328,7 +326,7 @@ bool is_thunk_call_type2(Instruction_t* insn, string ®, Instruction_t** newin
* is_thunk_add - Check the given instruction for an add of reg, return the constant K1
*/
/* note: offset is an output parameter */
-bool is_thunk_add(Instruction_t *insn, string reg, string &offset)
+bool is_thunk_add(Instruction_t *insn, string reg, uint64_t &offset)
{
//DISASM d;
//Disassemble(insn,d);
@@ -349,9 +347,10 @@ bool is_thunk_add(Instruction_t *insn, string reg, string &offset)
return false;
// offset=string(d.Argument2.ArgMnemonic);
- offset=d.getOperand(1).getString();
+ //offset=d.getOperand(1).getString();
+ offset=d.getOperand(1).getConstant();
- virtual_offset_t intoff=strtol(offset.c_str(),NULL,16);
+ virtual_offset_t intoff=d.getOperand(1).getConstant(); // strtol(offset.c_str(),NULL,16);
/* bounds check gently */
if(0<intoff && intoff<100)
@@ -379,7 +378,8 @@ void check_func_for_thunk_calls(Function_t* func)
{
// check for a call, followed by an add of reg (note the output params of reg and offset)
- string reg,offset;
+ string reg;
+ uint64_t offset=0;
if(is_thunk_call(insn,reg) &&
is_thunk_add(insn->GetFallthrough(),reg,offset))
{
@@ -410,7 +410,8 @@ void check_non_funcs_for_thunks(FileIR_t *firp)
{
// check for a call, followed by an add of reg (note the output params of reg and offset)
- string reg,offset;
+ string reg;
+ uint64_t offset=0;
if(is_thunk_call(insn,reg) &&
is_thunk_add(insn->GetFallthrough(),reg,offset))
{
@@ -471,12 +472,12 @@ void find_all_module_starts(FileIR_t* firp, set<virtual_offset_t> &thunk_bases)
if(insn->GetFallthrough() && insn->GetTarget())
{
// check for a call, followed by an add of reg (note the output params of reg and offset)
- string reg,offset;
+ string reg;
+ uint64_t offset=0;
if(is_thunk_call(insn,reg) &&
is_thunk_add(insn->GetFallthrough(),reg,offset))
{
- virtual_offset_t thunk_base=insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+
- strtol(offset.c_str(),NULL,16);
+ virtual_offset_t thunk_base=insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+ offset;
if(thunk_bases.find(thunk_base)==thunk_bases.end())
cout<<"Found new thunk at "<<insn->GetAddress()->GetVirtualOffset()<<" with base: "<<hex<<thunk_base<<endl;
thunk_bases.insert(thunk_base);
@@ -486,8 +487,7 @@ void find_all_module_starts(FileIR_t* firp, set<virtual_offset_t> &thunk_bases)
{
if(newinsn && is_thunk_add(newinsn,reg,offset))
{
- virtual_offset_t thunk_base=insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+
- strtol(offset.c_str(),NULL,16);
+ virtual_offset_t thunk_base=insn->GetFallthrough()->GetAddress()->GetVirtualOffset()+ offset;
if(thunk_bases.find(thunk_base)==thunk_bases.end())
cout<<"Found new thunk at "<<insn->GetAddress()->GetVirtualOffset()<<" with base: "<<hex<<thunk_base<<endl;
thunk_bases.insert(thunk_base);
diff --git a/libIRDB/test/fill_in_indtargs.cpp b/libIRDB/test/fill_in_indtargs.cpp
index 13dfc76665d0039983d7cad2e13bbd290e089d35..7989d1bcfb3d4379063196c2dfc3d831649ff35d 100644
--- a/libIRDB/test/fill_in_indtargs.cpp
+++ b/libIRDB/test/fill_in_indtargs.cpp
@@ -776,7 +776,7 @@ I5: 0x809900e <text_handler+51>: jmp ecx
Instruction_t* I5=insn;
Instruction_t* I4=NULL;
- Instruction_t* I3=NULL;
+// Instruction_t* I3=NULL;
// check if I5 is a jump
if(strstr(disasm.getMnemonic().c_str() /*disasm.Instruction.Mnemonic*/, "jmp")==NULL)
return;
@@ -796,27 +796,33 @@ I5: 0x809900e <text_handler+51>: jmp ecx
if(!backup_until("add", I4, I5))
return;
- // backup and find the instruction that's an movsxd before I7
- if(!backup_until("lea", I3, I4))
+ const auto d4=DecodedInstruction_t(I4);
+ if(!d4.hasOperand(1) || !d4.getOperand(1).isMemory())
return;
+ // found that sometimes I3 is set a different way,
+ // and that it's perfectly reasonable to just use I4's offsets.
+ // backup and find the instruction that's an movsxd before I7
+// if(!backup_until("lea", I3, I4))
+// return;
+
// grab the offset out of the lea.
//DISASM d2;
//Disassemble(I3,d2);
- DecodedInstruction_t d2(I3);
+ //DecodedInstruction_t d2(I3);
// get the offset from the thunk
- virtual_offset_t table_offset=d2.getAddress(); // d2.Instruction.AddrValue;
+ virtual_offset_t table_offset=d4.getOperand(1).getMemoryDisplacement(); //d2.getAddress(); // d2.Instruction.AddrValue;
if(table_offset==0)
return;
-cout<<hex<<"Found (type2) switch dispatch at "<<I3->GetAddress()->GetVirtualOffset()<< " with table_offset="<<table_offset<<endl;
+cout<<hex<<"Found (type2) switch dispatch at "<<I5->GetAddress()->GetVirtualOffset()<< " with table_offset="<<table_offset<<endl;
/* iterate over all thunk_bases/module_starts */
for(set<virtual_offset_t>::iterator it=thunk_bases.begin(); it!=thunk_bases.end(); ++it)
{
- //virtual_offset_t thunk_base=*it;
- virtual_offset_t table_base=*it+table_offset;
+ virtual_offset_t thunk_base=*it;
+ virtual_offset_t table_base=(*it)+table_offset;
// find the section with the data table
EXEIO::section *pSec=find_section(table_base,elfiop);
@@ -840,7 +846,7 @@ cout<<hex<<"Found (type2) switch dispatch at "<<I3->GetAddress()->GetVirtualOffs
virtual_offset_t table_entry=*table_entry_ptr;
// cout<<"Checking target base:" << std::hex << table_base+table_entry << ", " << table_base+i*4<<endl;
- if(!is_possible_target(table_base+table_entry,table_base+i*4))
+ if(!is_possible_target(table_base+table_entry,table_base+i*4) && !is_possible_target(thunk_base+table_entry,table_base+i*4))
break;
}
/* did we finish the loop or break out? */
@@ -858,8 +864,10 @@ cout<<hex<<"Found (type2) switch dispatch at "<<I3->GetAddress()->GetVirtualOffs
virtual_offset_t table_entry=*table_entry_ptr;
if(getenv("IB_VERBOSE")!=0)
- cout<<"Found switch table (thunk-relative) entry["<<dec<<i<<"], "<<hex<<table_base+table_entry<<endl;
- if(!possible_target(table_base+table_entry,table_base+i*4,prov))
+ cout<<"Found switch table (thunk-relative) entry["<<dec<<i<<"], "<<hex<<table_base+table_entry<<" or "<<thunk_base+table_entry<<endl;
+ auto t1=possible_target(table_base+table_entry,table_base+i*4,prov);
+ auto t2=possible_target(thunk_base+table_entry,table_base+i*4,prov);
+ if(!t1 && !t2)
break;
}
}