Private method to tell if the instruction pointed to by the program counter is a control flow instruction. Currently only works for x86 and amd64 architectures.
(self)
| 886 | return result |
| 887 | |
| 888 | def __is_control_flow(self): |
| 889 | """ |
| 890 | Private method to tell if the instruction pointed to by the program |
| 891 | counter is a control flow instruction. |
| 892 | |
| 893 | Currently only works for x86 and amd64 architectures. |
| 894 | """ |
| 895 | jump_instructions = ( |
| 896 | "jmp", |
| 897 | "jecxz", |
| 898 | "jcxz", |
| 899 | "ja", |
| 900 | "jnbe", |
| 901 | "jae", |
| 902 | "jnb", |
| 903 | "jb", |
| 904 | "jnae", |
| 905 | "jbe", |
| 906 | "jna", |
| 907 | "jc", |
| 908 | "je", |
| 909 | "jz", |
| 910 | "jnc", |
| 911 | "jne", |
| 912 | "jnz", |
| 913 | "jnp", |
| 914 | "jpo", |
| 915 | "jp", |
| 916 | "jpe", |
| 917 | "jg", |
| 918 | "jnle", |
| 919 | "jge", |
| 920 | "jnl", |
| 921 | "jl", |
| 922 | "jnge", |
| 923 | "jle", |
| 924 | "jng", |
| 925 | "jno", |
| 926 | "jns", |
| 927 | "jo", |
| 928 | "js", |
| 929 | ) |
| 930 | call_instructions = ("call", "ret", "retn") |
| 931 | loop_instructions = ("loop", "loopz", "loopnz", "loope", "loopne") |
| 932 | control_flow_instructions = call_instructions + loop_instructions + jump_instructions |
| 933 | isControlFlow = False |
| 934 | instruction = None |
| 935 | if self.pc is not None and self.faultDisasm: |
| 936 | for disasm in self.faultDisasm: |
| 937 | if disasm[0] == self.pc: |
| 938 | instruction = disasm[2].lower().strip() |
| 939 | break |
| 940 | if instruction: |
| 941 | for x in control_flow_instructions: |
| 942 | if x in instruction: |
| 943 | isControlFlow = True |
| 944 | break |
| 945 | return isControlFlow |