Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

read branch targets as signed integers #18

Merged
merged 1 commit into from
Jun 30, 2022
Merged

Conversation

blattm
Copy link
Contributor

@blattm blattm commented Jun 30, 2022

As defined by the standard for CIL code, targets of branch and switch instructions are stored as signed offsets [ECMA 335, Chapter III, 3.15 and 3.66].

Dncil previously read unsigned values in those cases, which caused issues for me. This is now fixed.

The code is probably based on dnlib, which in fact reads unsigned values and works just fine. Because dnlib is written in C#, an overflow will occur when negative offsets are encountered, so it still behaves like signed values were read. Such overflows do not occur in python, so the implementation has to differ from dnlib here.

There might be more of such issues hidden somewhere. Maybe it would be worth comparing the rest of the reader code to the specification as well...

@mike-hunhoff
Copy link
Collaborator

Thank you for catching this! Yes as mentioned in our README dncil is based on the CIL parsing code found in dnlib. I have opened a new issue to double-check the types emitted by dncil's reader.

@mike-hunhoff mike-hunhoff merged commit fc54f50 into mandiant:main Jun 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants