Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unsupported masking on instruction - Attempting to mask EBP in 'mov' instruction #16

Open
recvfrom opened this issue May 8, 2018 · 0 comments

Comments

@recvfrom
Copy link

recvfrom commented May 8, 2018

From the latest code in the 'dev' branch:

[CASC] Unsupported masking on instruction. Please open an issue in the git repo with the below information:
  disassembly: mov     dword ptr [ebp-88h], 6E72656Bh
  opcodes: c7 85 78ffffff 6b65726e
{'address': 106L,
 'bytes': ['c7', '85', '78', 'ff', 'ff', 'ff', '6b', '65', '72', '6e'],
 'disassembly': 'mov     dword ptr [ebp-88h], 6E72656Bh',
 'disp': ['x\xff\xff\xff', '0xffffff78L'],
 'imm': ['kern', '0x6e72656b'],
 'modr/m': ['\x85', {'mod': 2, 'reg': 0, 'rm': 5}],
 'opcode': ['\xc7', 'mov'],
 'prefix': [''],
 'sib': ['']}
========================================
Traceback (most recent call last):
  File "C:/Program Files/IDA 7.0/plugins/casc_plugin.py", line 1818, in apply_mask
    self.data.mask_opcodes(self.ui.mask.get_masking())
  File "C:/Program Files/IDA 7.0/plugins/casc_plugin.py", line 1278, in mask_opcodes
    data = self.parser.mask_instruction(instr.ea, mask_options)
  File "C:/Program Files/IDA 7.0/plugins/casc_plugin.py", line 923, in mask_instruction
    current_disassembly[i] = self.mask_operand(x, mask_re, value)
  File "C:/Program Files/IDA 7.0/plugins/casc_plugin.py", line 1190, in mask_operand
    if re.search(operand, to_mask):
  File "C:\Program Files\Python27\Lib\re.py", line 146, in search
    return _compile(pattern, flags).search(string)
  File "C:\Program Files\Python27\Lib\re.py", line 251, in _compile
    raise error, v # invalid expression
sre_constants.error: bad character range

NOTE, I was running with the following change to allow me to use CASC with an x86 shellcode file:

        #   Currently only supports intel_x86
        #if get_file_type() not in [1, 6, 9]:
        #    msg_str = '{0} does not support this file type.\n'
        #    IDAW.msg(msg_str.format(self.wanted_name))
        #    return IDAW.PLUGIN_SKIP
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant