#1
|
|||
|
|||
Strange CALL disasm in Hiew
E8 cd | CALL rel32 | Call near, relative, displacement relative to next instruction
Hiew 6.82 rev H .00479DC6: E8198EBD38 call 038C52BE4 .00479DCB: 8BF0 mov esi,eax Hiew 7.01 Rev A .00479DC6: E8198EBD38 call 038C44BE4 .00479DCB: 8BF0 mov esi,eax OllyDbg v1.10 00479DC6 E8198EBD38 call 39052BE4 00479DCB 8BF0 mov esi, eax IDA 4.7.0.830 .text:00479DC6 E8198EBD38 call near ptr 39052BE4h .text:00479DCB 8BF0 mov esi, eax 39052BE4 is only right address, but different versions of hiew have different results in decoding call, and all hiew results are wrong |
#2
|
|||
|
|||
As i remember there ware some problems decoding CALL offsets (in little bit older versions rather than you mentioned) caused by PE-sections physical and virtual sizes mismatches. I don't remember the reason clearly, so maybe I'm wrong.
But the problem did take place Last edited by amitophia; 03-21-2005 at 04:49. |
#3
|
|||
|
|||
But it can't be anything to do with PE headers, since the instruction is relative. You are given the current address, you can always work out what the target address is, and both the HIEW results are clearly wrong.
Aur |
#4
|
|||
|
|||
Oh, I remembered my problem. Hiew was confusing absolute and relative offesets.
When enter an edit mode (F3) hiew switches to absolute offset mode, and there were some mistakes either in absolute mode or in noramal one. It's really not that you are talking about. I just checked your example in hiew 6.86b on WinHex. I replaced code at offset .00479DC6 with yours and I was shown right result ("call 39052BE4"), but in hiew 7.01a it was "call 038C44BE4". It seems strange Something goes wrong from between 6.86b and 6.86h Well, you may e-mail SEN (hiew's author) this issue, but I don't know whether he cheks his mailbox (you can find e-mail address is in hiew_en.txt file) ---------------------------------- Maybe it's because of out-of-range address. For example, hiew 6.85 does not change call address to relative offset regardless of current view mode (Global/Local) if it's out of file. But it seems strange that 6.82 is bad, 6.86 is ok, and 7.01 is bad again |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
mnemodll.dll - 16/32-bit disasm engine library for WIN32. | dosprog | Community Tools | 3 | 04-13-2018 06:30 |
DISA - Chunk 16/32 disasm (DOS 16-bit apps) | dosprog | Community Tools | 0 | 02-15-2018 08:11 |