immunant / ibresolver

A QEMU TCG plugin for resolving indirect branches.
BSD 3-Clause "New" or "Revised" License
4 stars 3 forks source link

Consecutive indirect branches are not handled properly #8

Open ayrtonm opened 2 years ago

ayrtonm commented 2 years ago

When the plugin encounters consecutive indirect branches the the indirect_branch_exec callback is registered for both, but branch_skipped is also registered for the second. This means that results may vary depending on which callback is executed first.

This could be fixed by not registering the branch_skipped for the second instruction (i.e. the branch_skipped callback that corresponds to skipping the first branch). Since this scenario is rare in practice, the plugin currently just emits a warning to stdout when it runs into this. It'd be good to have some test cases before making the fix to verify it'll work as expected.