Invalid instructions when reading from a rust x64 binary #321
Answered
by
wtfsck
RadonCoding
asked this question in
Q&A
-
I'm reading the .text section of a rust x64 binary and getting the following invalid instructions. Here is my code https://paste.ofcode.org/6rTPNCdgRzRZN6VdVvfk98
|
Beta Was this translation helpful? Give feedback.
Answered by
wtfsck
Jul 25, 2022
Replies: 1 comment 2 replies
-
My goal is to decode the instructions then modify them and encode |
Beta Was this translation helpful? Give feedback.
2 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Compilers add data to the code section too so you can't just assume everything is valid code.
You have to figure out which bytes are code and which aren't. Start at some known locations that you know are code, then disassemble that code, follow branches etc, to find new code (see
Instruction::flow_control()
method). Whatever hasn't been decoded could still be code but it's e.g. referenced from some data. Or it's just data.