-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PE32 reassembly issues #24
Comments
|
It's worth noting that a lot of these issues appear to be exclusive to 32-bit binaries. When I try to reassemble the Upon investigation this would make sense because the exports are genuinely different between 32-bit and 64-bit Windows libraries. Here is some of the output of I've also had issues on some disassemblies produced by |
That second warning should be fixed now, but the entry point with a single underscore is still necessary as @itsmattkc shows 32-bit and 64-bit export symbols are handled differently.
Yes, this is something I am still unhappy about, but it appears impossible to provide a symbol name in the assembly for 32-bit that We have sidestepped the issue by adding a
That should fix all the |
|
What about the resource section issue? |
Can you provide a sample binary for the resource section issue? The instructions are fixed in gtirb-pprinter: GrammaTech/gtirb-pprinter@70ecde0 |
The |
I see, nice idea. But it does not work on Linux / in the docker container of course: |
Yes, that is annoying. With your suggestion of UASM though, we should be able to use I'll give an update when that lands in gtirb-pprinter. |
Maybe with an .rc file like: testrsrc RCDATA
{
0x77,
0x77,
0x77,
0x00,
0x6b,
0x6b,
0x6b,
0x00,
0x5f,
0x5f,
0x5f,
0x00,
0x53,
0x53,
0x53,
0x00,
0x47,
0x47,
0x47,
0x00
} Just with data that looks like an actual |
Oh, this is clearer to me now. I overlooked the fact the original false positive you showed was in the Please correct me if I am wrong, but we should never be symbolizing data in resource data. Right? |
I think so cause it's pure external data, wouldn't know how to put a reference in there. |
Following up on #11 (comment).
Should be
pushad
/popad
andfdivr ST(0),ST(0)
(D8 F8).And there are false positives where it identified RGB data in the resource section as references, I'm not sure if that is even possible:
Also there were issues with name mangling. I had to use
ml /link /entry:_EntryPoint
instead of/entry:__EntryPoint
(it then still resulted inwarning LNK4216: Exported entry point __EntryPoint
though).Then it generated import declarations like
while
C:\Program Files (x86)\Windows Kits\10\Lib\10.0.18362.0\um\x86\kernel32.Lib
contains stdcall decoratedThe text was updated successfully, but these errors were encountered: