-
Notifications
You must be signed in to change notification settings - Fork 951
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Refactor capstone2llvmir #115
Comments
Make sure This ASM code: 0x403975: be d8 42 40 00 mov esi, 0x4042d8
0x40397a: 83 c6 05 add esi, 0x5
0x40397d: b9 04 00 00 00 mov ecx, 0x4
0x403982: bf fe 42 40 00 mov edi, 0x4042fe
0x403987: f3 a4 rep movsb
0x403989: 46 inc esi
0x40398a: b9 04 00 00 00 mov ecx, 0x4
0x40398f: f3 a4 rep movsb
0x403991: 46 inc esi
0x403992: b9 04 00 00 00 mov ecx, 0x4
0x403997: f3 a4 rep movsb
0x403999: 46 inc esi
0x40399a: b9 04 00 00 00 mov ecx, 0x4
0x40399f: f3 a4 rep movsb Gets decompiled to (at the time of report): char * g110; // 0x4042d8
char * g111; // 0x4042dd
char * g112; // 0x4042de
char * g113; // 0x4042df
char * g114; // 0x4042e0
...
char * g117; // 0x4042fe
...
memcpy((char *)&g117, (char *)&g111, 4);
memcpy((char *)&g117, (char *)&g112, 4);
memcpy((char *)&g117, (char *)&g113, 4);
g4 = (int32_t)memcpy((char *)&g117, (char *)&g114, 4); Where It should be something like: memcpy(g117, g111, 4);
memcpy(g117+4, g111+5, 4);
memcpy(g117+8, g111+10, 4);
memcpy(g117+12, g111+15, 4); Where second operands get increased by 5 bytes, not one, and first operands by 4 bytes, not 0. |
TODO for me: write a few words about the basic principles to wiki once this is done. Something like this comment in #193. |
FIxed by c2ed626. |
The current implementation is an early prototype. We should refactor it in order to make it prettier and easier to use and develop for others. Do the following:
The text was updated successfully, but these errors were encountered: