-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Expose Relative Instruction API #443
Comments
for the request (1), we can do this without changing the core interface: adding a new group, for example CS_GRP_BRANCH_REL, so you can verify if the instruction belongs to this group. if you can, please make the change the instruction definition on for (2), this reminds me of this pull-request: #331. |
Unfortunately (2) is extremely important for my particular use case. I'm writing a hooking library and it has to fixup those copied relative bytes, if i can't write to the displacement (CurIns->Address+CurIns->DispOffset) then i can't do any fixing up. I also cannot find the file at the path you specified. Perhaps this offset feature could be retrieved using just a function, instead of modifying the cs_ins struct (similar to cs_reg_name) |
but which API can be use to retrieve this "offset"? it does not fit any current API, as far as i can see. |
There is a way, but it is a hack of course. After opcode bytes you may have an optional displacement coded in 1, 2 or 4 bytes, then followed by an optional immediate coded in 1, 2 or 4 bytes.
so if we know if there is an immediate/displacement and which size they are, you can retrieve their offsets. The thing is, do we have their size as they are encoded? |
hlide i tried doing exactly that by looping the opcodes but their size members don't seem to have any meaning. Would it make sense to implement this in the detail structure for x86, so that the interface would be: Either or:
|
with AVX, I believe you can have a supplementary byte which ends the instruction. |
Something like that would be perfect |
I've begun implementing the api proposed by hlide in pull #444. I don't have enough knowledge of all the cases and platforms to implement this for anything other than x86, i would appreciate if others could help pick this one up. |
what about feature (1), you suggested a group like CS_GRP_BRANCH_REL , would it be possible to do it as stevemk14ebr suggested, to have some sort of flag(or group) like X86_INS_REL ? This would be necessary to instructions like "lea rdx, qword ptr [rip + disp]" not only "jmp [rip + disp]" |
CS_GROUP_PCREL? |
sounds fine! |
we have been talking about adding this group for relative branch instructions, so you are welcome to send a PR to do this. the place to look at is the mapping tables in thanks. |
like i said above the file you mention doesn't exist. |
sorry, i was talking about the "next" branch, which many people are using now. for the "master" branch, you need to look at |
Yes, I also need a possibility to hide the register for instructions "lea rdx, qword ptr [rip + disp]" like it IDA does. Something like "lea rdx, qword ptr [absolute_address_value]". It should be optional of course. |
progopis what you suggest is a separate issue than what this one is about. |
It's not about changing insn->op_str. I support your idea of special flag for relative instructions. I already write a special case for X86_INS_LEA and ModRM 00.reg.0101 with REX prefix. Actually, I just need this value for analyzing. There is a macro X86_REL_ADDR(insn) but it needs a special flag to use it easy. |
this feature should be good, both offset and size is a must have |
Yes please! The offset where in the instruction bytes is the operand or actual opcode is a really nice to have! |
Feature Request:
Many modern disassemblers expose somewhere in their api a way to determine if a current instruction is relative to EIP/RIP in some manner. The capstone api only exposes the Opcode Types of MEM,IMM,REG, and FP. When writing code relocation utilities such as hooking libraries this is a significant drawback as it is currently impossible to determine if an instruction is relative or not and then modify that displacement if necessary.
This could be resolved by exposing two new features to the api:
Ex (x64):
Proposed API:
The text was updated successfully, but these errors were encountered: