search

lifting-bits / dds

Dr. Disassembler
35 stars 9 forks source link

Refactor arch #4

Closed pgoodman closed 3 years ago

pgoodman commented 3 years ago

This refactors out architecture names, instruction types, control-flow edge types, and the instruction decoder.

One thing I've noticed is that LIEF doesn't apply relocations eagerly (as IDA does), so in the PIE ELF hello world, we see the following:

  Adding instruction 67b: e8 00 00 00 00        call 0x680
    -> 680 ControlFlowEdgeKind.FUNCTION_CALL
    -> 680 ControlFlowEdgeKind.FUNCTION_CALL_RETURN

That 00 00 00 00 is basically saying: some missing value hereand the0x680there is the next instruction. So it looks as if it's mean to be an inline pc thunk, but really it's meant to becall _printf(into the.plt`). I have asked on the LIEF Gitter about this.