Problem with rel32 generation?

Index > Compiler Internals > Problem with rel32 generation?

Author

Thread

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 14 Mar 2010, 00:17

Code:

BASE = 0

use64

org BASE
label delta at $$ - $8000'0000 +2 ; +2 is the minimum value allowed
jnz delta ; Encoded as 0F 85 FC FF FF 7F ; Is this encoding correct??? (7F is not a typo)


org BASE
jnz alpha ; Encoded as 0F 85 FB FF FF 7F
label alpha at $$ + $8000'0000 +1 ; Why this is the maximum allowed? Shouldn't it be +5

macro display_number num
{
local ..var, ..nibble
common
..var = num

display '0x'

repeat 16
  ..nibble = ..var shr 60 and $F

  if ..nibble  > 9
    display ..nibble + 'a' - 10
  else
    display ..nibble + '0'
  end if

  ..var = ..var shl 4
end repeat

display 13, 10
}

display_number delta
display_number alpha

Code:

flat assembler  version 1.69.12  (907535 kilobytes memory)
0xffffffff80000002
0x0000000080000001
2 passes, 12 bytes.

14 Mar 2010, 00:17

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20445
Location: In your JS exploiting you and your system

revolution 14 Mar 2010, 01:28

Actually it is a bug:

Code:

use64

je ($+6)-0x7ffffffe    ;0f 84 02 00 00 80
je ($+6)-0x7fffffff       ;0f 84 01 00 00 80
je ($+6)-0x80000000       ;0f 84 00 00 00 80
je ($+6)-0x80000001       ;0f 84 ff ff ff 7f (bug)
je ($+6)-0x80000002 ;0f 84 fe ff ff 7f (bug)
je ($+6)-0x80000003 ;0f 84 fd ff ff 7f (bug)
je ($+6)-0x80000004 ;0f 84 fc ff ff 7f (bug)
je ($+6)+0x7ffffffb ;0f 84 fb ff ff 7f

14 Mar 2010, 01:28

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr 14 Mar 2010, 01:31

LocoDelAssembly,

Yes, there is a problem. calculate_jump_offset function in X86_64.INC incorrectly assumes that jcc instruction is exactly 2 bytes long.

14 Mar 2010, 01:31

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8358
Location: Kraków, Poland

Tomasz Grysztar 16 Mar 2010, 11:39

baldr wrote:

Yes, there is a problem. calculate_jump_offset function in X86_64.INC incorrectly assumes that jcc instruction is exactly 2 bytes long.

It's a bit more complex than that, but there might be some bug anyway. I'm going to check it out later today.

16 Mar 2010, 11:39

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr 16 Mar 2010, 18:31

Tomasz Grysztar,

Yes it is, but mov ecx, edx / cdq / cmp edx, ecx / jne value_out_of_range uses calculated rel32 without adjustment to check for out-of-range jump target.

Another kind of a problem is with jmp rel16 – the following code happily compiles:

Code:

use16
jmp there
times 0x8000 nop
there:

Quick'n'dirty fix is already done, but it is sooo crude.

16 Mar 2010, 18:31

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8358
Location: Kraków, Poland

Tomasz Grysztar 16 Mar 2010, 18:43

baldr wrote:

Another kind of a problem is with jmp rel16 – the following code happily compiles:
Code:
use16
jmp there
times 0x8000 nop
there:    

And it SHOULD compile. With "use16" the default size of target address is word (IP register), hence this jump with offset -8000h jumps to address 8003h (which is "(3-8000h) AND 0FFFFh"), and this is exactly what it is supposed to do.

See this thread for some more details about how it was implemented: http://board.flatassembler.net/topic.php?t=5162

16 Mar 2010, 18:43

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr 16 Mar 2010, 20:08

Tomasz Grysztar,

Sorry, I forgot about address wrap-around. Not a much 16-bit programming lately.

16 Mar 2010, 20:08

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum