bongtrop / hbctool

Hermes Bytecode Reverse Engineering Tool (Assemble/Disassemble Hermes Bytecode)
MIT License
444 stars 71 forks source link

Jump to an address in instruction file #5

Closed euzada closed 3 years ago

euzada commented 3 years ago

Hi,

First thank you for the support of Version 59. It works well for me.

I am trying to understand the bytecode in the instruction file and have a hard time knowing the offset of the jump.

I looked at the source code of Hermes, they mentioned clearly that : "The address is relative to the offset of the instruction."

In the instruction file, I don't see the addresses of instructions.

Here is my question let's say the code says: Line 100 JmpFalse Addr8:18, Reg8:0 my understanding is if Reg8:0 is false, then the instruction will jump to a relative address to the JumpFalse instruction by 18. Is that means it will jump to line 118?

The number 18 in Addr8:18 is what I don't understand. How I will know where the code will jump if Reg8:0 is False? If it is True, I imagine the next instruction will be executed, but if it is false, I can't see the addresses to knows what will be the next executed instruction.

I know it is Hermes question, but I hope you can make it clear for me.

Thank you.

bongtrop commented 3 years ago

@euzada for discussion about Hermes, please communicate in another channel (https://gitter.im/hbctool/community).

g2asell2019 commented 2 years ago

Hi euzada,

Perhaps could you share with me some knowledge about hermes bytecode

In your example: 338519 Jmp Addr8:26 this line will jump to next 26 bytes, but do you know how to count the next 26 bytes?

What is the line of next 26 bytes

Thank you.

338516 JStrictEqual Addr8:14, Reg8:0, Reg8:4
338517 NewArray Reg8:0, UInt16:0
338518 StoreToEnvironment Reg8:1, UInt8:0, Reg8:3
338519 Jmp Addr8:26
338520 StoreToEnvironment Reg8:1, UInt8:0, Reg8:3
338521 GetByIdShort Reg8:3, Reg8:2, UInt8:4, UInt8:76
338522 ; Oper[3]: String(76) 'ids'
338523
338524 GetByIdShort Reg8:2, Reg8:3, UInt8:5, UInt8:193
338525 ; Oper[3]: String(193) 'map'
338526
338527 CreateClosure Reg8:1, Reg8:1, UInt16:7384
338528 Call2 Reg8:0, Reg8:2, Reg8:3, Reg8:1
338529 Ret Reg8:0
338530EndFunction
338531
338532Function<>7384(2 params, 2 registers, 0 symbols):
338533 GetEnvironment Reg8:0, UInt8:0
338534 LoadFromEnvironment Reg8:0, Reg8:0, UInt8:0
338535 GetById Reg8:1, Reg8:0, UInt8:1, UInt16:25298
338536 ; Oper[3]: String(25298) 'entries'
338537
338538 LoadParam Reg8:0, UInt8:1
338539 GetByVal Reg8:0, Reg8:1, Reg8:0
338540 Ret Reg8:0
338541EndFunction
338542
338543Function<>7385(2 params, 13 registers, 1 symbols):
338544 CreateEnvironment Reg8:1
338545 LoadParam Reg8:0, UInt8:1
338546 GetById Reg8:3, Reg8:0, UInt8:1, UInt16:14342
338547 ; Oper[3]: String(14342) 'connections'
338548
338549 GetById Reg8:2, Reg8:3, UInt8:2, UInt16:15225
338550 ; Oper[3]: String(15225) 'currentUserFollowingsIds'
338551
338552 GetByIdShort Reg8:4, Reg8:2, UInt8:3, UInt8:20
338553 ; Oper[3]: String(20) 'type'
338554
338555 LoadConstString Reg8:0, UInt16:11196
338556 ; Oper[1]: String(11196) 'loaded'
338557
338558 JStrictEqual Addr8:14, Reg8:0, Reg8:4
338559 NewArray Reg8:0, UInt16:0
338560 StoreToEnvironment Reg8:1, UInt8:0, Reg8:3
338561 Jmp Addr8:26
338562 StoreToEnvironment Reg8:1, UInt8:0, Reg8:3
338563 GetByIdShort Reg8:3, Reg8:2, UInt8:4, UInt8:76
338564 ; Oper[3]: String(76) 'ids'
338565
338566 GetByIdShort Reg8:2, Reg8:3, UInt8:5, UInt8:193
338567 ; Oper[3]: String(193) 'map'
338568
338569 CreateClosure Reg8:1, Reg8:1, UInt16:7386
338570 Call2 Reg8:0, Reg8:2, Reg8:3, Reg8:1
338571 Ret Reg8:0
338572EndFunction