Open radare opened 5 years ago
We need a hint to tell r2 how big the jmptable for a specific JMP RAX is. and ignore the cmpval
Implemented ahv
to set anal hints on the value of the jmp rax to redefine the jmptbl size
Any reason why radare find jmptbl size in before bb first not in current bb first?
if (is_delta_pointer_table (anal, fcn, op.addr, op.ptr, &jmptbl_addr, &jmp_aop)) {
ut64 table_size, default_case = 0;
// we require both checks here since try_get_jmptbl_info uses
// BB info of the final jmptbl jump, which is no present with
// is_delta_pointer_table just scanning ahead
// try_get_delta_jmptbl_info doesn't work at times where the
// lea comes after the cmp/default case cjmp, which can be
// handled with try_get_jmptbl_info
if (try_get_jmptbl_info (anal, fcn, jmp_aop.addr, bb, &table_size, &default_case)
|| try_get_delta_jmptbl_info (anal, fcn, jmp_aop.addr, op.addr, &table_size, &default_case)) {
ret = try_walkthrough_jmptbl (anal, fcn, depth, jmp_aop.addr, jmptbl_addr, op.ptr, 4, table_size, default_case, 4);
if (ret) {
lea_jmptbl_ip = jmp_aop.addr;
}
}
}
r_anal_op_fini (&jmp_aop);
}
changing the order fix the issue
if (is_delta_pointer_table (anal, fcn, op.addr, op.ptr, &jmptbl_addr, &jmp_aop)) {
ut64 table_size, default_case = 0;
// we require both checks here since try_get_jmptbl_info uses
// BB info of the final jmptbl jump, which is no present with
// is_delta_pointer_table just scanning ahead
// try_get_delta_jmptbl_info doesn't work at times where the
// lea comes after the cmp/default case cjmp, which can be
// handled with try_get_jmptbl_info
if (try_get_delta_jmptbl_info (anal, fcn, jmp_aop.addr, op.addr, &table_size, &default_case)
|| try_get_jmptbl_info (anal, fcn, jmp_aop.addr, bb, &table_size, &default_case) ) {
ret = try_walkthrough_jmptbl (anal, fcn, depth, jmp_aop.addr, jmptbl_addr, op.ptr, 4, table_size, default_case, 4);
if (ret) {
lea_jmptbl_ip = jmp_aop.addr;
}
}
}
Can you make a PR?
On 17 Jan 2020, at 03:08, d4em0n notifications@github.com wrote:
changing the order fix the issue
if (is_delta_pointer_table (anal, fcn, op.addr, op.ptr, &jmptbl_addr, &jmp_aop)) { ut64 table_size, default_case = 0; // we require both checks here since try_get_jmptbl_info uses // BB info of the final jmptbl jump, which is no present with // is_delta_pointer_table just scanning ahead // try_get_delta_jmptbl_info doesn't work at times where the // lea comes after the cmp/default case cjmp, which can be // handled with try_get_jmptbl_info if (try_get_delta_jmptbl_info (anal, fcn, jmp_aop.addr, op.addr, &table_size, &default_case) || try_get_jmptbl_info (anal, fcn, jmp_aop.addr, bb, &table_size, &default_case) ) { ret = try_walkthrough_jmptbl (anal, fcn, depth, jmp_aop.addr, jmptbl_addr, op.ptr, 4, table_size, default_case, 4); if (ret) { lea_jmptbl_ip = jmp_aop.addr; } } }
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.
Can you re-check if the issue is still in r2 from git?
Problem is related to the recursive analysis of some jumptables.
Here's the jmp rax:
after analysis we get only 2 cases
if we disassemble back and chk the jmptable we see the comparison is 6, not 2
by chking the jmptbl we can observer this:
there are actually 7 destinations for this jmp rax. in fact the code that fills de gap with cmpval+1, but seems like because of the order to bb analysis the cmpval is lost when reaching the jmp rax.
binary: ls.zip