diff --git a/src/vmemu_t.cpp b/src/vmemu_t.cpp index c6218cf..f76ba4e 100644 --- a/src/vmemu_t.cpp +++ b/src/vmemu_t.cpp @@ -94,16 +94,25 @@ namespace vm static const auto _already_traced = [ & ]( std::uintptr_t code_block_addr ) -> bool { return std::find_if( code_blocks.begin(), code_blocks.end(), [ & ]( const auto code_block_data ) -> bool { - return code_block_data.first.vip_begin == code_block_addr; + return code_block_data.first.vip_begin == code_block_addr || + // sometimes the code block address is displaced by 1... and another byte for the + // opcode... + code_block_data.first.vip_begin == code_block_addr - 2 || + code_block_data.first.vip_begin == code_block_addr - 1; } ) != code_blocks.end(); }; - static const auto _traced_all_paths = [ & ]( const auto &code_blocks ) -> bool { - for ( const auto &[ code_block, cpu_context ] : code_blocks ) - if ( code_block.jcc.has_jcc && ( !_already_traced( code_block.jcc.block_addr[ 0 ] ) || - !_already_traced( code_block.jcc.block_addr[ 1 ] ) ) ) - return false; - return true; + static const auto _traced_all_paths = + [ & ]( const std::vector< std::pair< vm::instrs::code_block_t, std::shared_ptr< cpu_ctx > > > &code_blocks ) + -> bool { + return std::find_if( + code_blocks.begin(), code_blocks.end(), + []( const std::pair< vm::instrs::code_block_t, std::shared_ptr< cpu_ctx > > &code_block_data ) + -> bool { + return code_block_data.first.jcc.has_jcc && + ( !_already_traced( code_block_data.first.jcc.block_addr[ 0 ] ) || + !_already_traced( code_block_data.first.jcc.block_addr[ 1 ] ) ); + } ) == code_blocks.end(); }; static const auto _trace_branch = [ & ]( vm::instrs::code_block_t &code_block, @@ -123,7 +132,6 @@ namespace vm // change the top qword on the stack to the branch rva... // the rva is image base'ed and only the bottom 32bits... - std::uintptr_t branch_rva = ( ( branch_addr - vmctx->module_base ) + vmctx->image_base ) & 0xFFFFFFFFull; uc_mem_write( uc, code_block.vinstrs.back().trace_data.regs.rbp, &branch_rva, sizeof branch_rva ); diff --git a/test.vmp2 b/test.vmp2 new file mode 100644 index 0000000..157ecf3 Binary files /dev/null and b/test.vmp2 differ diff --git a/vmptest8.vmp.exe b/vmptest8.vmp.exe new file mode 100644 index 0000000..525e969 Binary files /dev/null and b/vmptest8.vmp.exe differ