avast / avast/retdec

x86: file segment register calls are ignored after decoding

Open
#742 1 comment 0 reactions 1 assignee Claimed by @PeterMatula View on GitHub
C-bin2llvmir P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Some calls are missing after decoding of file [user32.zip](https://github.com/avast/retdec/files/4486356/user32.zip).

For example:
```
0x7dcc7ec5: 64 ff 15 c0 00 00 00 call dword ptr fs:[0xc0]
```
an in LLVM module dump after decoding:
```llvm
; 0x7dcc7ec5
store volatile i64 2110553797, i64* @_asm_program_counter

; 0x7dcc7ecc
```
However, `capstone2llvmir` can translate such calls:
```
retdec-capstone2llvmir -a x86 -c "64 ff 15 c0 00 00 00"
```
```llvm
store volatile i64 4096, i64* @0
%0 = load i32, i32* @esp
%1 = sub i32 %0, 4
%2 = inttoptr i32 %1 to i32*
store i32 4103, i32* %2
store i32 %1, i32* @esp
%3 = load i32, i32 addrspace(257)* inttoptr (i32 192 to i32 addrspace(257)*)
call void @1(i32 %3)
```
Investigate why they disappear and fix it. Something like this should be in the output:
```c
((int (*)(void))__readfsdword(0xC0u))();
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.