jonomango / chum Goto Github PK

I understand that you won't be working on this project anymore, but maybe it will help someone in the future. This is an interesting project.

1. For example, there is such a problem in _vcrt_InitializeCriticalSectionEx()->try_get_function() [in CRT with /MT] with the rva address in the current instructions
   49 8B 84 FF ? ? ? ? mov rax, rva ????[r15+rdi*8]
49 8B 9C F7 ? ? ? ? mov rbx, rva ????[r15+rsi*8]
4D 8B BC F7 ? ? ? ? mov r15, ds:rva ????[r15+rsi*8]
   
   Just for the test, this instruction can be caught in this way (this is not the best way, just for test)
   if (instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.attributes == (ZYDIS_ATTRIB_HAS_MODRM | ZYDIS_ATTRIB_HAS_SIB | ZYDIS_ATTRIB_HAS_REX | ZYDIS_ATTRIB_ACCEPTS_SEGMENT) && instr.length >= 8 && instr.raw.disp.value > 0x1000/*better to do > sec_text_addr + sec_text_size*/)

2. There is also a problem with rva addresses in .rdata
   
   

3. I also suspect that there will be problems with some short jmps