I am reversing an x86 ELF shared object library. Perhaps because of position independence, all functions begin with loading a constant offset into a register:

[... function prologue ...]
call    $+5
pop     eax             ; eax = eip = 0x4E2B
add     eax, 1009Dh     ; eax = 0x14EC8 = start of .got.plt section
mov     byte ptr [eax+194h], 0ACh
mov     dword ptr [eax+190h], 968CC5DEh

The first two instructions set eax to the current instruction's address. Then a constant offset is added, this offset is probably calculated during linking. From there on, all addresses are referenced relative eax (in this case, they point into the .bss segment).

I can manually calculate all addresses since the value of eax is fixed. Is there an automated way to resolve these fixed-register-offsets in IDA, such that IDA can properly resolve X-refs, etc?

  • AFAIR One of my colleagues used manticore (github.com/trailofbits/manticore) for something like this. Any working symbolic execution engine should also fit. – w s Mar 11 '18 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.