Skip to content
This repository has been archived by the owner on Aug 23, 2022. It is now read-only.

Not recognizing no-return windows syscall #322

Open
pgoodman opened this issue Nov 10, 2017 · 1 comment
Open

Not recognizing no-return windows syscall #322

pgoodman opened this issue Nov 10, 2017 · 1 comment

Comments

@pgoodman
Copy link
Collaborator

mcsema-disass does not recognize this call to RtlFailFast as a no-return instruction, and so the following innocuous errors pop up:

E1109 19:37:00.836913 12635 Function.cpp:437] Block 140005e0b has no terminator, and instruction at 140005e10 is not a local no-return function call.

image

@artemdinaburg
Copy link
Contributor

We could (and maybe should?) treat all two-byte interrupts (opcode CD xx versus CC) as noreturn? I know technically CD 03 is still an INT3, but no sane compiler would emit it, and we officially do not support obfuscated code.

For this specific case it obviously makes more sense to call the high level handler of RtlFailFast. Maybe we could have a Windows-specific CFG recovery fix here? Or, alternatively, a Windows-specific int 0x29 handler?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
No open projects
SEEL
  
To-Do
Development

No branches or pull requests

2 participants