In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace:
RIP register instruction 0x7fff751fed17 mov rbx, 0xffffffffffdff000 0x7fff751fed1e lsl r11d, eax 0x7fff751fed22 xor r15d, r15d 0x7fff751fed25 mov r10d, r11d 0x7fff751fed28 mov r9d, dword ptr [0xff5ff080] 0x7fff751fed30 test r9b, 0x1 0x7fff751fed34 jnz 0x7fff1fdb4fdf 0x7fff751fed3a mov rax, qword ptr [0xff5ff0a8] 0x7fff751fed42 mov r13d, dword ptr [0xff5ff088] 0x7fff751fed4a mov qword ptr [rdi], rax 0x7fff751fed4d mov edx, dword ptr [0xff5ff088] 0x7fff751fed54 mov r14, qword ptr [0xff5ff0b0]
To me, they are quite weird. First, some of them access directly to the memory, that means some addresses, e.g.
0xff5ff0a8 have been hard-coded into the program. Second, I find them nowhere in the loaded libraries and wget itself. Third, even more weird, by passing the parameter
(IARG_MEMORYREAD_EA) to get the virtual addresses of the accessed memories. I got the addresses, e.g.
0xffffffffff5ff0a8, etc, and all of them do not belong to the program's memory space.
Coud anyone give me some suggestions ?.