Skip to main content
Notice removed Draw attention by CommunityBot
Bounty Ended with ynwarcs's answer chosen by CommunityBot
Mod Moved Comments To Chat
added 49 characters in body
Source Link

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description hereenter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern SearchInstruction Pattern Search feature and I insertin Ghidra, inserting the first 4 manual movss of the sequence (selecting onlythe instructions show in the VS Debugger, after enabling Show Code Bytes; i.e. in order f3 0f 10/f3 0f 11/f3 0f 10/f3 0f 11):

enter image description here

It says not result found, even if I search for random piece of code, some are present:enter image description here

enter image description here it doesn't return any hit.

(i.e. So, is this should hita mismatch from VS Code disassembly and the Listing elaborated by Ghidra, not sure why it doesnt...)or am I searching in a wrong way?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature and I insert 4 manual movss (selecting only instructions):

enter image description here

It says not result found, even if I search for random piece of code, some are present:

enter image description here

(i.e. this should hit, not sure why it doesnt...)

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature in Ghidra, inserting the first 4 movss of the sequence (selecting the instructions show in the VS Debugger, after enabling Show Code Bytes; i.e. in order f3 0f 10/f3 0f 11/f3 0f 10/f3 0f 11):

enter image description here

it doesn't return any hit.

So, is this a mismatch from VS Code disassembly and the Listing elaborated by Ghidra, or am I searching in a wrong way?

added 199 characters in body
Source Link

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature and I insert 4 manual movss (selecting only instructions):

enter image description here

It says not result found, even if I search for random piece of code, some are present:

enter image description here

(i.e. this should hit, not sure why it doesnt...)

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature and I insert 4 manual movss (selecting only instructions):

enter image description here

It says not result found...

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature and I insert 4 manual movss (selecting only instructions):

enter image description here

It says not result found, even if I search for random piece of code, some are present:

enter image description here

(i.e. this should hit, not sure why it doesnt...)

Notice added Draw attention by markzzz
Bounty Started worth 50 reputation by markzzz
added 222 characters in body
Source Link

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature and I insert 4 manual movss (selecting only instructions):

enter image description here

It says not result found...

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:

enter image description here

What I'm looking for so is (for the same DLL, decompiled in Ghidra) to intercept the sequence movss/movss/movss/movss/lea/lea/lea, in the hoping to intercept the C++ Clamp function I've defined:

template <typename T>
T Clamp(const T& min, const T& max, const T& value)
{
    if (value < min)
    {
        return min;
    }
    else if (value > max)
    {
        return max;
    }
    return value;
}

What's the correct way to do this in Ghidra?

If I try Instruction Pattern Search feature and I insert 4 manual movss (selecting only instructions):

enter image description here

It says not result found...

Source Link
Loading