Master/upx
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

i386 stub filters 0x49 and 0x46 really are different (but similar!)

Browse Source 
modified:   filter/filter_impl.cpp
	modified:   p_lx_elf.cpp
	modified:   stub/src/arch/i386/bxx.S
This commit is contained in:
John Reiser
2024-07-28 15:04:57 -07:00
parent b94a150685
commit 3d58035b41
3 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/filter/filter_impl.cpp
+2 -2
View File
@@ -204,8 +204,8 @@
{ 0x36, 6, 0x00ffffff, f_ctoj32_e8e9_bswap_le, u_ctoj32_e8e9_bswap_le, s_ctoj32_e8e9_bswap_le },
// 32-bit calltrick with jmp, optional jcc; runtime can unfilter more than one block
// 2024-07-18 Note: two tags for the same filter
{ 0x46, 6, 0x00ffffff, f_ctok32_e8e9_bswap_le, u_ctok32_e8e9_bswap_le, s_ctok32_e8e9_bswap_le },
// Note 0x46 uses 'ctoj', while 0x49 uses 'ctok'.
{ 0x46, 6, 0x00ffffff, f_ctoj32_e8e9_bswap_le, u_ctoj32_e8e9_bswap_le, s_ctoj32_e8e9_bswap_le },
{ 0x49, 6, 0x00ffffff, f_ctok32_e8e9_bswap_le, u_ctok32_e8e9_bswap_le, s_ctok32_e8e9_bswap_le },
// 24-bit calltrick for arm