Fix: #1342

Handle `endbr..` instructions in x86-64 ELF PLT stubs.
uxmal · Apr 18, 2024 · d90bdc7 · d90bdc7
1 parent cbba51e
commit d90bdc7
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/src/Environments/SysV/ArchSpecific/TrampolineFinder.cs b/src/Environments/SysV/ArchSpecific/TrampolineFinder.cs
@@ -668,6 +668,14 @@ public static (Expression?, Address?) X86_64(IProcessorArchitecture arch, Addres
             var instr = instrs.FirstOrDefault();
             if (instr == null)
                 return null;
+            // Eat leading nops; these are caused by endbr64 instructions.
+            if (instr is RtlNop)
+            {
+                instrs = instrs.Skip(1);
+                instr = instrs.FirstOrDefault();
+                if (instr is null)
+                    return null;
+            }
             // Match x86-64 pattern.
             // jmp [destination]
             Address? addrTarget = null;