-
Notifications
You must be signed in to change notification settings - Fork 64
Description
Hi,
I have a DLL in which a constant is being symbolised incorrectly.
Ddisasm generates the assembly: shr rcx, <symbolic expression>
when it is actually a constant. It's also a pretty small constant (<255), so unsure how why it was symbolized. Trying to fix it with a symbolic_operand_point
hint did not work.
Taking a closer look using the debug-dir option, it looks like the may_have_symbolic_immediate
rule triggered on this address for some reason, and it looks like it doesn't take into account symbolic_operand_point
when deriving this rule.
Would you know what hint I can give ddisasm to not apply the may_have_symbolic_immediate
rule to this address? (It would be nice to have a catch-all 'this operand is not symbolic' rule/hint).
Also, I believe the second parameter of shr
and related instructions can never be symbolic (I understand it always must be an immediate). Maybe this could be taken into account when creating symbolic operands (that it is impossible for a operand which must be an immediate to be symbolic).