ChrisZim / edb-debugger

Automatically exported from code.google.com/p/edb-debugger
GNU General Public License v2.0
0 stars 0 forks source link

EDB scrolls by bytes, not instruction #1

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
It would be nice if EDB could scroll by whole instructions. This is 
unfortunately difficult because instructions are variable length on x86.

Original issue reported on code.google.com by evan.teran on 3 Oct 2012 at 2:59

GoogleCodeExporter commented 9 years ago

Original comment by evan.teran on 3 Oct 2012 at 3:06

GoogleCodeExporter commented 9 years ago
The easy half of this is completed. EDB will now scroll by instructions when 
scrolling down. This is easy because we just increase by the size of the 
topmost shown instruction. Up is a more complicated problem to address since 
instructions are variable length and multiple encodings may line up with the 
current instruction.

A good solution will likely involve a combination of aligning to nearest known 
function from analysis and/or disassembling many instructions back and seeing 
what lines up with the current topmost instruction.

Original comment by evan.teran on 3 Oct 2012 at 3:24

GoogleCodeExporter commented 9 years ago
pseudo function for disassembling back

I attached a file with (pseudo) code that shows a very simple way of achieveing 
it.
While it looks kinda crude, it works well about 95% of the time. It's probably 
not something that should be relied on in a critical situation but it's 
perfectly fine for something like scrolling up.
In case of failure you can simply scroll up a few lines more and it should 
auto-correct itself.

Original comment by evan.teran on 3 Oct 2012 at 3:26

Attachments:

GoogleCodeExporter commented 9 years ago
This is implemented to a reasonable degree in the latest code. It certainly 
isn't perfect, but it is there.

I will continue to make efforts to improve the scrolling (especially upwards), 
but for now, I think it's fair to consider this bug resolved.

Original comment by evan.teran on 3 Oct 2012 at 3:26