Comments (6)
Hi @colbacc8
Thanks for the detail submission, however if I don't have the actual disassembled bytes I can't help you.
If you can please share them with me, then I will be able to cross check with the documentation and distorm's results and learn if it's legit result or not.
Thanks
from distormx.
@colbacc8 bumping. Requiring more info please.
from distormx.
Hi gdabah, sorry for the late reply...
I noticed several NOP DWORD in the execution trace translated by distorm3, sometimes are correct sometimes seem not...
- working correctly case:
Disassebling with objdump the executed binary, this is an instruction correctly translated in NOP DWORD
output of trace information + distorm3 (fields are: 1)physical address, 2) virtual address, 3) instruction size, 4) opcode, 5) coreid 6)mnemonics + operand (output of distorm3)
- The translation seems different in case of a kernel instruction.
This is the instructions disassembled from the used linux kernel image, which is a callq to the "rcu_irq_enter" syscall
the mnemonic and operand output in the distorm3 is the following:
as you can see, the callq is translated with NOP DWORD.
What I noticed is that also the opcode differs...
I followed the trace and the objdump output of the linux kernel instruction by instruction and at the point of the NOP DWORD should be exactly the callq to the syscall...
from distormx.
from distormx.
sorry, it was a mistake in linking the screenshot...I updated my previous answer...
the virtual addresses are now equal (second field of the output trace)
yes, I'm decoding in 64 bits mode.
I'm controlling also if the problem depends on the relocation...
from distormx.
It doesn’t matter if the virtual addresses happen to be correct if the actual bytes disassembled are not! Means it’s a different instruction.
make sure you start disassembling from a fixed known address like the start of the function and even then if there’s data in between distorm doesn’t know it - it reads everything linearly nevertheless so you can get different stuff. Comparison must be done correctly using same bytes only. In case of different addresses something is wrong with your file-memory offsets or usage as explained.
Thanks and good luck
from distormx.
Related Issues (2)
- Update to distorm-3.5 HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from distormx.