Skip to content

Issue with may_have_symbolic_immediate rule #85

@avncharlie

Description

@avncharlie

Hi,

I have a DLL in which a constant is being symbolised incorrectly.
Ddisasm generates the assembly: shr rcx, <symbolic expression> when it is actually a constant. It's also a pretty small constant (<255), so unsure how why it was symbolized. Trying to fix it with a symbolic_operand_point hint did not work.

Taking a closer look using the debug-dir option, it looks like the may_have_symbolic_immediate rule triggered on this address for some reason, and it looks like it doesn't take into account symbolic_operand_point when deriving this rule.

Would you know what hint I can give ddisasm to not apply the may_have_symbolic_immediate rule to this address? (It would be nice to have a catch-all 'this operand is not symbolic' rule/hint).

Also, I believe the second parameter of shr and related instructions can never be symbolic (I understand it always must be an immediate). Maybe this could be taken into account when creating symbolic operands (that it is impossible for a operand which must be an immediate to be symbolic).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions