Keelrleek/Harbor
1
1 Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Queue skips catch and unwind funclets (they open on the parent's frame); ruling #12777

Browse Source
This commit is contained in:
KeelrLeek committed 2026-10-07 18:10:13 -05:00
1 parent b8dab67871
commit b28f80f1a4
1 file changed
+4
Download Patch File Download Diff File Expand all files Collapse all files
harbor/queue.py
+4
View File
@@ -207,6 +207,10 @@ class FunctionQueue:
head = self.r.read(addr, 10) if int(facts[addr].get("size") or 0) == 10 else b"" head = self.r.read(addr, 10) if int(facts[addr].get("size") or 0) == 10 else b""
if head[:1] and 0xB8 <= head[0] <= 0xBF and head[5:6] == b"\xe9": if head[:1] and 0xB8 <= head[0] <= 0xBF and head[5:6] == b"\xe9":
continue # mov reg, imm32; jmp: an at-exit destructor thunk or an SEH handler stub (compiler's) continue # mov reg, imm32; jmp: an at-exit destructor thunk or an SEH handler stub (compiler's)
first = self.r.read(addr, 3)
if len(first) == 3 and first[0] in (0x8B, 0x8D, 0xFF, 0x83, 0xC7, 0x89) and (first[1] & 0xC7) == 0x45 \
and first[2] >= 0x80:
continue # opens on the parent's [ebp-x] with no frame: a catch or unwind funclet (ruling #12777)
score, reasons = self.score(addr, facts, named, rejected, similar_readable, with_convention=False) score, reasons = self.score(addr, facts, named, rejected, similar_readable, with_convention=False)
ranked.append((score, addr, reasons)) ranked.append((score, addr, reasons))
ranked.sort(reverse=True) ranked.sort(reverse=True)