From afc574503fa060e6106e1d76c0fb77abdda417f9 Mon Sep 17 00:00:00 2001 From: Alexis Engelke Date: Sat, 7 Mar 2020 14:30:07 +0100 Subject: [PATCH] Decode jump targets as offset if address is NULL Addresses relative to the actual address of the instruction are decoded as new offset operand, where the RIP has to be added to obtain the real value. For backwards compatibility, the new behavior is only exposed if the address of the instruction is specified as zero. --- decode.c | 5 ++++- fadec.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/decode.c b/decode.c index 8a5b078..5922cca 100644 --- a/decode.c +++ b/decode.c @@ -597,7 +597,10 @@ fd_decode(const uint8_t* buffer, size_t len_sz, int mode_int, uintptr_t address, if (imm_control == 4) { - instr->imm += instr->address + off; + if (instr->address != 0) + instr->imm += instr->address + off; + else + operand->type = FD_OT_OFF; #if defined(ARCH_X86_64) // On x86-64, jumps always have an operand size of 64 bit. if (mode == DECODE_64) diff --git a/fadec.h b/fadec.h index 4c44270..abd848a 100644 --- a/fadec.h +++ b/fadec.h @@ -50,6 +50,7 @@ typedef enum { FD_OT_REG = 1, FD_OT_IMM = 2, FD_OT_MEM = 3, + FD_OT_OFF = 4, } FdOpType; typedef enum {