DynamoRIO / DynamoRIO/dynamorio
treat int 0x2d as a direct or indirect branch for cases where it does not raise an exception but directly transfers control
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
Xref #2126: when int 2d raises EXCEPTION_BREAKPOINT, we have to deal with ExceptionAddress different from CONTEXT.Eip.
int 2d has other behavior: sometimes it doesn't raise an exception and simply functions as a branch. This issue covers that case. Xref the discussion in https://github.com/DynamoRIO/dynamorio/pull/2218 from which I'm quoting here:
If I build 64-bit, instead of 8 EXCEPTION_BREAKPOINTs (i.e., an exception for every single int 2d) I only get 4 -- so is it that for 32-bit, an exception is raised every time on int 2d, but for 64-bit it varies based on eax?
It seems like we have to treat int 2d as a control transfer instruction for 64-bit. So you have the rules for exactly where it goes? Is it based only on eax? So if we can find the eax statically we can treat it as a direct
branch, but if the eax set is not visible in the current block we may have to treat it as an indirect branch.
Contributor guide
Assessment
This issue has not been assessed yet.