Index: courgette/rel32_finder_x64.cc |
diff --git a/courgette/rel32_finder_x64.cc b/courgette/rel32_finder_x64.cc |
index b9b04582304ca458784750573ffe7c9d79d3facf..54503654b4c4b7906e47f1dc43a0dea495944b9d 100644 |
--- a/courgette/rel32_finder_x64.cc |
+++ b/courgette/rel32_finder_x64.cc |
@@ -56,27 +56,21 @@ void Rel32FinderX64::Find(const uint8_t* start_pointer, |
if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form |
if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely |
rel32 = p + 2; |
- } else if (p[0] == 0xFF && (p[1] == 0x15 || p[1] == 0x25)) { |
- // rip relative CALL/JMP |
+ } else if ((p[0] == 0xFF && |
+ (p[1] == 0x15 || p[1] == 0x25)) || // CALL / JMP |
+ ((p[0] == 0x89 || p[0] == 0x8B || |
+ p[0] == 0x8D) && // MOV / LEA |
huangs
2016/06/17 18:05:51
I think this is sufficient complex to warrant more
etiennep
2016/06/27 19:41:21
Done.
|
+ (p[1] & 0xC7) == 0x05)) { // Dst reg : [05,0D,...3D] = |
+ // [rax,rbx,...,rdi]/[r8,r9,...,r15] |
rel32 = p + 2; |
is_rip_relative = true; |
} |
} |
- // TODO(etiennep): Many rip mov/lea variants are not detected. Experiment, |
- // fix and combine logic. |
if (p + 7 <= end_pointer) { |
huangs
2016/06/17 18:05:51
// 7-byte instructions:
// [48/4C] 89 [05|0D|...
etiennep
2016/06/27 19:41:21
Done.
|
if ((p[0] & 0xFB) == 0x48 && // Dst reg : 48/4C [rax-rdi]/[r8-r15] |
- p[1] == 0x8D && // LEA |
+ (p[1] == 0x89 || p[1] == 0x8B || p[1] == 0x8D) && // MOV / LEA |
(p[2] & 0xC7) == 0x05) { // Dst reg : [05,0D,...3D] = |
// [rax,rbx,...,rdi]/[r8,r9,...,r15] |
- // LEA dst, QWORD [rip + rel32] |
- rel32 = p + 3; |
- is_rip_relative = true; |
- } else if ((p[0] & 0xFB) == 0x48 && // Dst reg : 48/4C [rax-rdi]/[r8-r15] |
- p[1] == 0x8B && // MOV |
- (p[2] & 0xC7) == 0x05) { // Dst reg : [05,0D,...3D] = |
- // [rax,rbx,...,rdi]/[r8,r9,...,r15] |
- // MOV dst, QWORD PTR[rip + rel32] |
rel32 = p + 3; |
is_rip_relative = true; |
} |