Skip to content

Invalid instructions when reading from a rust x64 binary #321

Answered by wtfsck
RadonCoding asked this question in Q&A
Discussion options

You must be logged in to vote

Compilers add data to the code section too so you can't just assume everything is valid code.

You have to figure out which bytes are code and which aren't. Start at some known locations that you know are code, then disassemble that code, follow branches etc, to find new code (see Instruction::flow_control() method). Whatever hasn't been decoded could still be code but it's e.g. referenced from some data. Or it's just data.

Replies: 1 comment 2 replies

Comment options

You must be logged in to vote
2 replies
@wtfsck
Comment options

Answer selected by wtfsck
@RadonCoding
Comment options

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants
Converted from issue

This discussion was converted from issue #320 on July 25, 2022 04:26.