-
Notifications
You must be signed in to change notification settings - Fork 259
Closed
Labels
Component: WARPEffort: MediumIssues require < 1 month of workIssues require < 1 month of workImpact: LowIssue is a papercut or has a good, supported workaroundIssue is a papercut or has a good, supported workaround
Milestone
Description
Found at least one eggregious function signature in msvcrt_windows-x86.sig
that will cause it to match any 32bit x86 function with:
- save frame pointer prologue
- call of a function with a single 32bit argument pushed to the stack
- standard epilogue/return
Here's a screenshot of assembly from a simple hello world app that matches:
Here's the relevant section of the signature library:
We likely need to increase the minimum size function that signatures are attempted to match against and re-generate the libraries. (Because this particular signature contains an epilogue it's likely possible to simply increase the minimum match size but this may have other effects)
ccarpenter040x61616161
Metadata
Metadata
Assignees
Labels
Component: WARPEffort: MediumIssues require < 1 month of workIssues require < 1 month of workImpact: LowIssue is a papercut or has a good, supported workaroundIssue is a papercut or has a good, supported workaround