2 ms·
is the translation 100% static? for example if I do something like: function_pointer = blackbox_function_translator_does_not_understand(); function_poi
by benmmurphy 6y ago
is the translation 100% static? for example if I do something like:
function_pointer = blackbox_function_translator_does_not_understand();
function_pointer()
then how do we end up calling the correct address in arm64 land? there are no type tags in assembly to distinguish between integers and addresses. in QEMU my understanding is translation is done dynamically so addresses would float around in memory as x86_64 addresses and then when you tried to `call` them it would look up a mapping table. In QEMU I suspect they also try and optimise this case similar to a JIT using inline caching so most of the time you wouldn't actually hit the mapping table.
But if you are not dynamically converting x86_64 addresses to arm64 addresses then you need to understand what all the addresses in the program are and understand all the manipulations that might be performed on those addresses. now, you shouldn't actually be doing weird manipulations of addresses to functions in memory but if you are running obfuscated code this often happens.
I think in QEMU this would work assuming (myfun+4)() does something intelligent:
uint64_t add(uint64_t v) {
return v + 4;
}
void myfun();
int main() {
void (*x)() = &myfun;
x = (void*)add((uint64_t)x);
x();
printf("%lld\n", add(4));
}
if you are holding function addresses as arm64 addresses in memory then you need to dispatch add() based on whether the argument is an integer or an address.