keystone-engine / keystone

Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
http://www.keystone-engine.org
GNU General Public License v2.0
2.31k stars 459 forks source link

C# Binding ResolveSymbol never raised #337

Open i3jjnc68emm opened 6 years ago

i3jjnc68emm commented 6 years ago

Just tried the C# binding in ../bindings/csharp/ without modifying the code. It works fine but on unknown symbols it fails because the ResolveSymbol event is never raised.

I've used the example code and it cannot resolve '_j1'. Tested with x86 and x64 binaries from http://www.keystone-engine.org/download/

using(var keystone = new Keystone(KeystoneArchitecture.KS_ARCH_X86, KeystoneMode.KS_MODE_32, false))
{
   ulong address = 0;
   keystone.ResolveSymbol += (string s, ref ulong w) =>
   {
     //never raised...
     if (s == "_j1")
     {
       w = 0x1234abcd;
       return true;
     }
     return false;
   };

   KeystoneEncoded enc = keystone.Assemble("xor eax, eax; jmp _j1", address);

}
t1t7mgn6k1n commented 6 years ago

Demonstration:

untitled project

71 commented 6 years ago

FYI this feature was introduced after the last official release of Keystone, which is why this does not work.