Open
Description
Found at least one eggregious function signature in msvcrt_windows-x86.sig
that will cause it to match any 32bit x86 function with:
- save frame pointer prologue
- call of a function with a single 32bit argument pushed to the stack
- standard epilogue/return
Here's a screenshot of assembly from a simple hello world app that matches:
Here's the relevant section of the signature library:
We likely need to increase the minimum size function that signatures are attempted to match against and re-generate the libraries. (Because this particular signature contains an epilogue it's likely possible to simply increase the minimum match size but this may have other effects)