Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

not expected behavior when using sym resolver #581

Open
nyaoouo opened this issue Mar 26, 2024 · 0 comments
Open

not expected behavior when using sym resolver #581

nyaoouo opened this issue Mar 26, 2024 · 0 comments

Comments

@nyaoouo
Copy link

nyaoouo commented Mar 26, 2024

environment:
Python 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 22:03:32) [MSC v.1937 64 bit (AMD64)] on win32
keystone-engine 0.9.2 (from pip)

reproduce code:

import capstone
import keystone


def main():
    ks = keystone.Ks(keystone.KS_ARCH_X86, keystone.KS_MODE_64)
    cs = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)

    def resolver(key, p_value):
        if key == b'func_':
            p_value[0] = 0x9
            return True
        return False

    ks.sym_resolver = resolver

    code_1 = 'lea rax, [rip + func];call rax;func:mov al,1;ret;'
    code_2 = 'lea rax, [rip + func_];call rax;func:mov al,1;ret;'

    for i in cs.disasm(ks.asm(code_1, 0, True)[0], 0): print(f'{i.address:X}: {i.mnemonic} {i.op_str}')
    print('---')
    for i in cs.disasm(ks.asm(code_2, 0, True)[0], 0): print(f'{i.address:X}: {i.mnemonic} {i.op_str}')


if __name__ == '__main__':
    main()

expected ouptut:

0: lea rax, [rip + 2]
7: call rax
9: mov al, 1
B: ret 
---
0: lea rax, [rip + 2]
7: call rax
9: mov al, 1
B: ret 

actual output:

0: lea rax, [rip + 2]
7: call rax
9: mov al, 1
B: ret 
---
0: lea rax, [rip + 6] << here
7: call rax
9: mov al, 1
B: ret 
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant