Any suggestions on handling short and near jumps in real mode? #20606
TommyJerryMairo
started this conversation in
Show and tell
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
First, I appreciate all contributors who helped with this fantastic analysis tool. However, there is still room for improvement, which would make r2 better. One of that rooms might associate with the jump instruction under 16-bit real mode.
There is a coreboot binary customized by Nautilus for DefCon 2022 quals. It is uplifting that r2 could get the entry point and decode the far jump correctly:
![entry0](https://user-images.githubusercontent.com/12117512/185565647-5413b4a6-7516-4f32-9fe9-311e7e197ec5.png)
![shortjump](https://user-images.githubusercontent.com/12117512/185566565-f97b211e-bd34-4314-9804-24b73e2228a9.png)
![ESIL](https://user-images.githubusercontent.com/12117512/185567074-d7511395-321b-43ee-b6a3-efc421f51762.png)
Unfortunately, when it comes to short jumps, it seems that r2 is not aware of the current code segment where it wants to jump to
0000:e062
and0000:e076
instead off000:e062
andf000:e076
:One another observation is that there is no CS register in the ESIL VM:
While the after-boot real mode environment might be a perfect place where the ESIL emulation shows its power, as there's no syscall but interactions between registers and memory. However, I have to track the register values on a draft paper by hand thanks to the lack of CS register in ESIL VM ¯_(ツ)_/¯
Beta Was this translation helpful? Give feedback.
All reactions