GrammaTech / ddisasm

A fast and accurate disassembler
https://grammatech.github.io/ddisasm/
GNU Affero General Public License v3.0
645 stars 60 forks source link

How to locate the instruction address with the address written in facts files? #38

Closed BBge closed 2 years ago

BBge commented 2 years ago

For instance, one fact from cfg_edge.facts is: 4248448 4273824 false false call. According to the declaration of cfg_edge(src:address,dest:address,conditional:symbol,indirect:symbol,type:symbol), 4248448 is the source address and 4273824 is the destination address. But I cannot find the corresponding address in the assembly code. Could you please give some suggestions about how to find the corresponding address between the assembly code and the facts files? Thanks!

aeflores commented 2 years ago

Sorry for the late reply, the first thing I would suggest is to generate the assembly file with the debug option, e.g. ddisasm binary --debug --asm binary_listing.s. That will print addresses for all locations and print all the code in the binary without skipping functions defined by the compiler (the default printing policy will skip some parts of the binary that the compiler adds). Once you have the debug assembly listing, you should be able to find the hexadecimal versions of those addresses, i.e. 40d380 or 4136a0 in the listing file.

If that is still not the case, I would suggest sharing an example binary where this happens, so we can diagnose the problem better.

eschulte commented 2 years ago

I'm closing this as I believe the question has been answered, but please don't hesitate to reopen if any further followup would be useful.