pluginapi: fix hooks with negative rip offsets

fixes #4484
This commit is contained in:
Vaxry 2024-01-24 13:53:06 +00:00
parent df17991b1c
commit 754eaf5b8b

View file

@ -75,8 +75,9 @@ CFunctionHook::SAssembly CFunctionHook::fixInstructionProbeRIPCalls(const SInstr
if (code.contains("%rip")) { if (code.contains("%rip")) {
CVarList tokens{code, 0, 's'}; CVarList tokens{code, 0, 's'};
size_t plusPresent = tokens[1][0] == '+' ? 1 : 0; size_t plusPresent = tokens[1][0] == '+' ? 1 : 0;
std::string addr = tokens[1].substr(plusPresent, tokens[1].find("(%rip)") - plusPresent); size_t minusPresent = tokens[1][0] == '-' ? 1 : 0;
const uint64_t OFFSET = configStringToInt(addr); std::string addr = tokens[1].substr((plusPresent || minusPresent), tokens[1].find("(%rip)") - (plusPresent || minusPresent));
const uint64_t OFFSET = (minusPresent ? -1 : 1) * configStringToInt(addr);
if (OFFSET == 0) if (OFFSET == 0)
return {}; return {};
const uint64_t DESTINATION = currentAddress + OFFSET + len; const uint64_t DESTINATION = currentAddress + OFFSET + len;