Skip to content

Add more status codes to the encoder #265

@ZehMatt

Description

@ZehMatt

After some testing and messing around I noticed that the encoder doesn't provide a lot info when it comes to failures.
Example 1:

ZydisEncoderRequest req{};
req.mnemonic = ZYDIS_MNEMONIC_LEA;
req.operand_count = 2;
req.operands[0].type = ZYDIS_OPERAND_TYPE_REGISTER;
req.operands[0].reg.value = ZYDIS_REGISTER_RAX;
req.operands[1].type = ZYDIS_OPERAND_TYPE_MEMORY;
req.operands[1].mem.base = ZYDIS_REGISTER_RIP;
req.operands[1].mem.displacement = 0x1337;

Because the size is not specified on the memory operand it will result ZYDIS_STATUS_IMPOSSIBLE_INSTRUCTION, a better result would be something like "Invalid operand size" in this case.

Example 2:

ZydisEncoderRequest req{};
req.mnemonic = ZYDIS_MNEMONIC_JMP;
req.branch_type = ZydisEncodableBranchType::ZYDIS_ENCODABLE_BRANCH_TYPE_NONE;
req.operand_count = 1;
req.operands[0].type = ZYDIS_OPERAND_TYPE_IMMEDIATE;
req.operands[0].imm.u = 0x12;

Not assigning a branch type also leads to ZYDIS_STATUS_IMPOSSIBLE_INSTRUCTION

Example 3:

ZydisEncoderRequest req{};
req.mnemonic = ZYDIS_MNEMONIC_JMP;
req.branch_type = ZydisEncodableBranchType::ZYDIS_ENCODABLE_BRANCH_TYPE_SHORT;
req.operand_count = 1;
req.operands[0].type = ZYDIS_OPERAND_TYPE_IMMEDIATE;
req.operands[0].imm.u = 0xFFFFFFF;

Using immediate value outside the possible branch type range.

And so on.

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-encoderArea: EncoderC-enhancementCategory: Enhancement of existing featuresP-mediumPriority: Medium

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions