I like that the decompiler calls x86 INT 'swi(x)'. You can tell what architecture they were thinking about when they did that...pic.twitter.com/Nq3hdD5Dce
Show this thread
-
Ah, this is a bit sad. It doesn't know that __chkesp() does not touch ST0, which breaks dataflow analysis of float return values. I can't find a sane way to override it that doesn't involve declaring it as taking a float and returning a float, which would affect *every* call.pic.twitter.com/3IQPnlWFKE
Show this thread
I wonder if there's a way of customizing clobbers... if it knew __chkesp() does not clobber ST0 it would work. I can make it take an arg at ST0 and return in ST0 and at least get the dataflow, but then that gunks up every function that *doesn't* return a float...
-
-
Fixed it. You can define your own calling conventions easily enough by editing Ghidra/Processors/x86/data/languages/x86win.cspec. I just defined a __fastcall_nofloat that doesn't kill float regs, and it works now.pic.twitter.com/FbwgyQ4dqC
Show this threadThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
In the Edit Function you can modify the storage of each param/return selecting exotic registers or nothing
-
Yes, but you can't configure clobbers (or lack thereof). You can tell it what registers it *uses* but not which ones it *doesn't*.
End of conversation
New conversation -
-
-
have you got it configured not to provide unauthenticated RCE on LAN
-
Is by default, debug is optin
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.