Skip to content

msvcrt_windows-x86.sig contains overly broad signatures #3773

Open
@psifertex

Description

@psifertex

Found at least one eggregious function signature in msvcrt_windows-x86.sig that will cause it to match any 32bit x86 function with:

  • save frame pointer prologue
  • call of a function with a single 32bit argument pushed to the stack
  • standard epilogue/return

Here's a screenshot of assembly from a simple hello world app that matches:

Screenshot 2023-01-09 at 3 15 50 PM

Here's the relevant section of the signature library:

Screenshot 2023-01-09 at 3 12 10 PM

We likely need to increase the minimum size function that signatures are attempted to match against and re-generate the libraries. (Because this particular signature contains an epilogue it's likely possible to simply increase the minimum match size but this may have other effects)

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions