Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 03-17-2005, 10:34
retroer
 
Posts: n/a
Strange CALL disasm in Hiew

E8 cd | CALL rel32 | Call near, relative, displacement relative to next instruction

Hiew 6.82 rev H
.00479DC6: E8198EBD38 call 038C52BE4
.00479DCB: 8BF0 mov esi,eax

Hiew 7.01 Rev A
.00479DC6: E8198EBD38 call 038C44BE4
.00479DCB: 8BF0 mov esi,eax

OllyDbg v1.10
00479DC6 E8198EBD38 call 39052BE4
00479DCB 8BF0 mov esi, eax

IDA 4.7.0.830
.text:00479DC6 E8198EBD38 call near ptr 39052BE4h
.text:00479DCB 8BF0 mov esi, eax

39052BE4 is only right address, but different versions of hiew have different results in decoding call, and all hiew results are wrong
Reply With Quote
  #2  
Old 03-20-2005, 19:12
amitophia
 
Posts: n/a
As i remember there ware some problems decoding CALL offsets (in little bit older versions rather than you mentioned) caused by PE-sections physical and virtual sizes mismatches. I don't remember the reason clearly, so maybe I'm wrong.
But the problem did take place

Last edited by amitophia; 03-21-2005 at 04:49.
Reply With Quote
  #3  
Old 03-23-2005, 19:36
auroras
 
Posts: n/a
But it can't be anything to do with PE headers, since the instruction is relative. You are given the current address, you can always work out what the target address is, and both the HIEW results are clearly wrong.

Aur
Reply With Quote
  #4  
Old 03-24-2005, 05:40
amitophia
 
Posts: n/a
Oh, I remembered my problem. Hiew was confusing absolute and relative offesets.
When enter an edit mode (F3) hiew switches to absolute offset mode, and there were some mistakes either in absolute mode or in noramal one.
It's really not that you are talking about.

I just checked your example in hiew 6.86b on WinHex. I replaced code at offset .00479DC6 with yours and I was shown right result ("call 39052BE4"), but in hiew 7.01a it was "call 038C44BE4". It seems strange Something goes wrong from between 6.86b and 6.86h

Well, you may e-mail SEN (hiew's author) this issue, but I don't know whether he cheks his mailbox (you can find e-mail address is in hiew_en.txt file)
----------------------------------
Maybe it's because of out-of-range address. For example, hiew 6.85 does not change call address to relative offset regardless of current view mode (Global/Local) if it's out of file. But it seems strange that 6.82 is bad, 6.86 is ok, and 7.01 is bad again
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
mnemodll.dll - 16/32-bit disasm engine library for WIN32. dosprog Community Tools 3 04-13-2018 06:30
DISA - Chunk 16/32 disasm (DOS 16-bit apps) dosprog Community Tools 0 02-15-2018 08:11


All times are GMT +8. The time now is 11:01.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2022 )