Skip to content

Added function to calculate and encode relative operands#368

Merged
athre0z merged 4 commits intozyantific:masterfrom
mappzor:encode_rels
Jul 25, 2022
Merged

Added function to calculate and encode relative operands#368
athre0z merged 4 commits intozyantific:masterfrom
mappzor:encode_rels

Conversation

@mappzor
Copy link
Copy Markdown
Contributor

@mappzor mappzor commented Jul 20, 2022

Related to 268 and #345.

This PR introduces ZydisEncoderEncodeInstructionAbsolute function which accepts absolute addresses instead of:

  • RIP-relative operands (base is still EIP/RIP, displacement should contain absolute address)
  • relative immediates in branching instructions

First group of instructions is handled by patching displacement after encoding. Second group uses fast size prediction algorithm to find the right variant and calculate relative operand prior to encoding. This has less overhead than trying to brute-force encode different variants. Solutions exploits simplicity of branching instructions as they have less "moving parts" such as prefixes, ModR/M, SIB, etc. This allows for fast table lookups with some minor adjustments.

Let me know if you have any feedback. If we want to proceed with this solution I will clean up my test code and add it to this PR. Final test suite would be a small C tool triggered from usual python test scripts.

@mappzor
Copy link
Copy Markdown
Contributor Author

mappzor commented Jul 21, 2022

Pushed some tests, CI fails because I cannot commit workflow change:

       - name: Running regression tests (encoder)
         run: |
           cd tests
-          python3 regression_encoder.py ../build/ZydisFuzzReEncoding ../build/ZydisFuzzEncoder
+          python3 regression_encoder.py ../build/ZydisFuzzReEncoding ../build/ZydisFuzzEncoder ../build/ZydisTestEncoderAbsolute

@mappzor mappzor marked this pull request as ready for review July 21, 2022 00:28
@flobernd
Copy link
Copy Markdown
Member

flobernd commented Jul 21, 2022

Thanks a lot @mappzor 👍

I just pushed the workflow changes. There seems to be a minor string format issue, but other than that it looks very good 🙂

Copy link
Copy Markdown
Member

@flobernd flobernd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks again, that will make a lot of users happy!

Is there a python script to generate the new .inc file or was it rather "generated" by hand? 😄

@mappzor
Copy link
Copy Markdown
Contributor Author

mappzor commented Jul 22, 2022

There's a new mode added to the script, will push it in a moment. It's not the prettiest thing but it does the job.

Copy link
Copy Markdown
Member

@athre0z athre0z left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM as well, thanks a lot for tackling this!

@athre0z athre0z merged commit 503e064 into zyantific:master Jul 25, 2022
@mappzor mappzor deleted the encode_rels branch July 25, 2022 21:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants