Open trufae opened 2 years ago
0x64, 0x48, 0x8B, 0x04, 0x25, 0x28, 0x00, 0x00, 0x00
this is because we don't have a satisfying description for segments, e.g. esil cannot switch between 32 and 64 bit
any proposal for this @condret?
I think we can add a memory selector esil command, that takes the value from a register or immediate and passes it to configure "whatever" externally to the esil vm with a new callback. That can look like this:
65a114000000 mov eax, dword gs:[0x14]
now its: 0x14,[4],rax,=
but it shuold be:
0x14,gs,@=,[4],rax,=
this can be also useful for iobanks. so.. maybe we can setup the segments as different iobanks configured.
Maybe we need two commands, one for temporal iobank selection (gets discarted after reading the memory. or keeps working after change. This can be useful for emulating syscalls by doing a context switch exposing the kernel memory instead of userspace layout. I would say @@=
and @=
but maybe something like BANK
or easier for the reader.
shouldn't that be fs,0x28,+,[8],rax,:=
maybe instead of breaking all the current ops we can make the memory selector as a separate esil command.
gs,@@,0x14,[4],rax,=,0,@@
im proposing @@
but that could be anything else. the ranalesil struct can keep track of that variable that selects the memory bank or segment to use for reading or writing. this var ir reset after parsing every statement.
This could be also an internal var.