Breaking SigScanner change #1075
goaaats
announced in
Announcements
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Patch 6.3 Hotfix 1 has exposed a bug in our and CS's sigscanner implementation by letting signatures resolve to invalid data addresses.
If you resolve a signature using
GetStaticAddressFromSig
, and that signature starts in the middle of an instruction, you need to adjust your signature to avoid this case.If you passed an offset to it that would result in it not being at the start of an instruction, that offset needs to be removed or adjusted,
for example:
GetStaticAddressFromSig("48 8B 05 ?? ?? ?? ?? 48 85 C0 74 37 83 78 08 04", 2);
would result in it starting at the 0x05 byte instead of the 0x48 (start of the instruction) which would now break.Beta Was this translation helpful? Give feedback.
All reactions