You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I tried to unvirtualized the entry code of a protected binary. It seems the very first basic_block of entry code is classified into "switch case pattern", which is not supported in current version.
An example of "switch case pattern" is as following:
{(-0xe9d521f90e+qword[(0x4b62016+&&base)]#0x3dbddf3?)}
the meaning of this expression is read a qword from 0x4b62016+imagebase, add a imm -0xe9d521f90, and results in another imm, which is the finally branch destination.
In this very first basic_block, the number of destination is only one, which is not a real switch case.
I want to add support for this situation. Could give me some guidance for adding some code for this?
The text was updated successfully, but these errors were encountered:
I tried to unvirtualized the entry code of a protected binary. It seems the very first basic_block of entry code is classified into "switch case pattern", which is not supported in current version.
An example of "switch case pattern" is as following:
{(-0xe9d521f90e+qword[(0x4b62016+&&base)]#0x3dbddf3?)}
the meaning of this expression is read a qword from 0x4b62016+imagebase, add a imm -0xe9d521f90, and results in another imm, which is the finally branch destination.
In this very first basic_block, the number of destination is only one, which is not a real switch case.
I want to add support for this situation. Could give me some guidance for adding some code for this?
The text was updated successfully, but these errors were encountered: