Open gogo2464 opened 11 months ago
I think I see what might be happening here.
For some reason there are 2 copies of those symbols e.g. RegOpenKeyExA
. To avoid ambiguity, gtirb-pprinter renames the symbols by adding a suffix _disambig_0_1
but if those symbols are external, they should not be renamed.
This should be fixed in the pprinter.
I got the assembly with a command similar to ddisasm --asm out.sam in.exe
.
Are you sure the bug is in gtirb-pprinter and not from ddisasm? Ddisasm could rely on gtirb-pprinter after all.
Will somebody fix it or should I open a PR please?
on the same binary I also have ImageBase
not defined from object file.
I would like to edit:
EXTERN ___ImageBase:BYTE
because it is the only moment where ImageBase is present in the text file.
@aeflores If you think this is not related to ddiszasm / gtirb dev, could you send me an email please?
Ddisasm uses gtirb-pprinter as a library to generate assembly, so yeah this is a pprinter issue. I can look into it.
Regarding ImageBase, I think we define this as an external symbol so it can be defined by the linker when reassembling.
Should I set ImageBase from compile command option like /imageBase, remove the variable or something in order to fix it please?
If I set /base 50000
then could I remove the linked variable please?
/base 50000 remains the undefined symbal ImageBase.
The commit https://github.com/GrammaTech/ddisasm/commit/f6bea62e47a8f97fdef4a318ab5b1e5e2a35ec46 fixed the undefined externs (imports).
I checked that the resulting assembly successfully reassembles, the ___ImageBase
symbol is not a problem. You might want to run ddisasm
with the --generate-import-libs
option to generate .def
and .lib
files of the dependencies, or reassemble with gtirb-pprinter
's --binary
option.
great! I will test this week.
I am confused. could you provide the full command please?
It has been a while, but the following should work
ddisasm 29fd307edb4cfa4400a586d38116a90ce91233a3fc277de1cab7890e681c409a --ir nashta.gtirb
gtirb-pprinter nashta.gtirb -b nashta.rewritten
should it work with --asm option as well please?
nashta.zip Please provide as much of the following information as possible:
I had to patch the disassembled asm to remove section permissions in order to avoid compilator error. I also change the INCLUDELIB keyword arguments. Then, on this file, I did:
I have not sent the nashta malware in order to avoid to infect people by accident. I let the hash in the name instead. Could you ask me in person in order to disassemble it if you do not found it please?