From 037f078302b1bd007cf04055ea52e20d89e4386d Mon Sep 17 00:00:00 2001 From: momo5502 Date: Sun, 24 Aug 2025 13:49:46 +0200 Subject: [PATCH] Revert SGDT hooking support It's useless --- deps/unicorn | 2 +- src/analyzer/main.cpp | 13 ------------- .../unicorn-emulator/unicorn_x86_64_emulator.cpp | 14 -------------- src/emulator/arch_emulator.hpp | 1 - 4 files changed, 1 insertion(+), 29 deletions(-) diff --git a/deps/unicorn b/deps/unicorn index 2b224aeb..6d9cc937 160000 --- a/deps/unicorn +++ b/deps/unicorn @@ -1 +1 @@ -Subproject commit 2b224aebf89900f676ec48f45140e208d35e6c79 +Subproject commit 6d9cc93779a666ed9ce255624730e59e54b55019 diff --git a/src/analyzer/main.cpp b/src/analyzer/main.cpp index 8f7f109b..7d8e97af 100644 --- a/src/analyzer/main.cpp +++ b/src/analyzer/main.cpp @@ -473,19 +473,6 @@ namespace const auto concise_logging = !options.verbose_logging; - win_emu->emu().hook_instruction(x86_hookable_instructions::sgdt, [&](const uint64_t) { - const auto rip = win_emu->emu().read_instruction_pointer(); - const auto mod = get_module_if_interesting(win_emu->mod_manager, options.modules, rip); - - if (mod.has_value()) - { - win_emu->log.print(color::blue, "Executing SGDT instruction at 0x%" PRIx64 " (%s)\n", rip, - (*mod) ? (*mod)->name.c_str() : ""); - } - - return instruction_hook_continuation::run_instruction; - }); - win_emu->emu().hook_instruction(x86_hookable_instructions::cpuid, [&] { const auto rip = win_emu->emu().read_instruction_pointer(); const auto mod = get_module_if_interesting(win_emu->mod_manager, options.modules, rip); diff --git a/src/backends/unicorn-emulator/unicorn_x86_64_emulator.cpp b/src/backends/unicorn-emulator/unicorn_x86_64_emulator.cpp index cf4b9087..8a2afc46 100644 --- a/src/backends/unicorn-emulator/unicorn_x86_64_emulator.cpp +++ b/src/backends/unicorn-emulator/unicorn_x86_64_emulator.cpp @@ -33,8 +33,6 @@ namespace unicorn return UC_X86_INS_RDTSC; case x86_hookable_instructions::rdtscp: return UC_X86_INS_RDTSCP; - case x86_hookable_instructions::sgdt: - return UC_X86_INS_SGDT; default: throw std::runtime_error("Bad instruction for mapping"); } @@ -401,18 +399,6 @@ namespace unicorn container->add(std::move(wrapper), std::move(hook)); } - else if (inst_type == x86_hookable_instructions::sgdt) - { - function_wrapper wrapper([c = std::move(callback)](uc_engine*, const uint64_t data) { - return (c(data) == instruction_hook_continuation::skip_instruction) ? 1 : 0; - }); - - const auto uc_instruction = map_hookable_instruction(inst_type); - uce(uc_hook_add(*this, hook.make_reference(), UC_HOOK_INSN, wrapper.get_function(), wrapper.get_user_data(), 0, - std::numeric_limits::max(), uc_instruction)); - - container->add(std::move(wrapper), std::move(hook)); - } else { function_wrapper wrapper([c = std::move(callback)](uc_engine*) { diff --git a/src/emulator/arch_emulator.hpp b/src/emulator/arch_emulator.hpp index 99260c7d..f20283a1 100644 --- a/src/emulator/arch_emulator.hpp +++ b/src/emulator/arch_emulator.hpp @@ -50,7 +50,6 @@ enum class x86_hookable_instructions cpuid, rdtsc, rdtscp, - sgdt, }; // --[x86_64]-------------------------------------------------------------------------