In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace:
RIP register instruction
0x7fff751fed17 mov rbx, 0xffffffffffdff000
0x7fff751fed1e lsl r11d, eax
0x7fff751fed22 xor r15d, r15d
0x7fff751fed25 mov r10d, r11d
0x7fff751fed28 mov r9d, dword ptr [0xff5ff080]
0x7fff751fed30 test r9b, 0x1
0x7fff751fed34 jnz 0x7fff1fdb4fdf
0x7fff751fed3a mov rax, qword ptr [0xff5ff0a8]
0x7fff751fed42 mov r13d, dword ptr [0xff5ff088]
0x7fff751fed4a mov qword ptr [rdi], rax
0x7fff751fed4d mov edx, dword ptr [0xff5ff088]
0x7fff751fed54 mov r14, qword ptr [0xff5ff0b0]
To me, they are quite weird. First, some of them access directly to the memory, that means some addresses, e.g. 0xff5ff080
, 0xff5ff0a8
have been hard-coded into the program. Second, I find them nowhere in the loaded libraries and wget itself. Third, even more weird, by passing the parameter (IARG_MEMORYREAD_EA)
to get the virtual addresses of the accessed memories. I got the addresses, e.g. 0xffffffffff5ff080
, 0xffffffffff5ff0a8
, etc, and all of them do not belong to the program's memory space.
Coud anyone give me some suggestions ?.