Help with ddisasm hint

[avncharlie]

Hello,

I have a binary in which ddisasm incorrectly guesses that a data constant is a symbolic address. (i.e it generates assembly like cmp RCX,OFFSET SomeSymbol+70987, when it is actually a comparison to an integer constant).

I would like to use a hint to prevent this error. Is there some sort of hint I can use that would specify that there is no symbolic data access at this location, and it is just a constant?

Thanks

[avncharlie]

I think the unlikely_have_symbolic_immediate rule may be what I want:

ddisasm/src/datalog/code_inference.dl

Line 207 in 5a8779f

.decl unlikely_have_symbolic_immediate(EA:address)

But I'm unable to specify this in a hint file. When I try, I get this warning: WARNING: ignoring hint in line 1: unknown relation unlikely_have_symbolic_immediate

My hint file looks like:

disassembly.unlikely_have_symbolic_immediate    0x452bd1

[junghee]

Hi @avncharlie

Instead of unlikely_have_symbolic_immediate, you can use symbolic_operand_point: something like the following:

disassembly.symbolic_operand_point     0x452bd1     1     -100      "user-hint-constant"

1 is the operand index.
-100 is an arbitrary negative score sufficient to prevent the operand from being symbolized.
"user-hint-constant" is a brief description explaining the reason for this score.

Hope this helps.

[avncharlie]

Thanks, this worked!
I think it would be helpful to have a few more examples of user hints in the readme, including:

• Known code / not code (already in readme, and I believe is "valid/invalid")
• Not symbolic operand ("symbolic_operand_point" as above)
• Jump table manipulation (I.e adding/removing/modifying Symbol+Symbol data)