Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added function to calculate and encode relative operands #368

Merged
merged 4 commits into from
Jul 25, 2022

Conversation

mappzor
Copy link
Contributor

@mappzor mappzor commented Jul 20, 2022

Related to 268 and #345.

This PR introduces ZydisEncoderEncodeInstructionAbsolute function which accepts absolute addresses instead of:

  • RIP-relative operands (base is still EIP/RIP, displacement should contain absolute address)
  • relative immediates in branching instructions

First group of instructions is handled by patching displacement after encoding. Second group uses fast size prediction algorithm to find the right variant and calculate relative operand prior to encoding. This has less overhead than trying to brute-force encode different variants. Solutions exploits simplicity of branching instructions as they have less "moving parts" such as prefixes, ModR/M, SIB, etc. This allows for fast table lookups with some minor adjustments.

Let me know if you have any feedback. If we want to proceed with this solution I will clean up my test code and add it to this PR. Final test suite would be a small C tool triggered from usual python test scripts.

@mappzor
Copy link
Contributor Author

mappzor commented Jul 21, 2022

Pushed some tests, CI fails because I cannot commit workflow change:

       - name: Running regression tests (encoder)
         run: |
           cd tests
-          python3 regression_encoder.py ../build/ZydisFuzzReEncoding ../build/ZydisFuzzEncoder
+          python3 regression_encoder.py ../build/ZydisFuzzReEncoding ../build/ZydisFuzzEncoder ../build/ZydisTestEncoderAbsolute

@mappzor mappzor marked this pull request as ready for review July 21, 2022 00:28
@flobernd
Copy link
Member

flobernd commented Jul 21, 2022

Thanks a lot @mappzor 👍

I just pushed the workflow changes. There seems to be a minor string format issue, but other than that it looks very good 🙂

Copy link
Member

@flobernd flobernd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks again, that will make a lot of users happy!

Is there a python script to generate the new .inc file or was it rather "generated" by hand? 😄

@mappzor
Copy link
Contributor Author

mappzor commented Jul 22, 2022

There's a new mode added to the script, will push it in a moment. It's not the prettiest thing but it does the job.

Copy link
Member

@athre0z athre0z left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM as well, thanks a lot for tackling this!

src/Encoder.c Show resolved Hide resolved
@athre0z athre0z merged commit 503e064 into zyantific:master Jul 25, 2022
@mappzor mappzor deleted the encode_rels branch July 25, 2022 21:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants