Improve Jump Table Symbolization Algorithm

librw_x64/container.py

@@ -162,7 +162,7 @@ def __init__(self, name, start, sz, bytes, bind="STB_LOCAL"):
 
     def set_instrumented(self):
         self.instrumented = True
-    
+
     @property
     def true_name(self):
         if self.is_mangled and not self._true_name:
@@ -189,6 +189,17 @@ def is_valid_instruction(self, address):
 
         return False
 
+    def is_located_at_the_end_of_function(self, address):
+        assert self.cache, "Function not disassembled!"
+
+        for instruction in self.cache:
+            if instruction.address + instruction.sz == address:
+                if ".LLC%x:"%(address) not in instruction.after:
+                    instruction.after.append(".LLC%x:"%(address))
+                return True
+
+        return False
+
     def instruction_of_address(self, address):
         assert self.cache, "Function not disassembled!"
 

librw_x64/rw.py

@@ -627,10 +627,17 @@ def symbolize_switch_tables(self, container, context):
                         break
 
                     value = (value + swbase) & 0xFFFFFFFF
-                    if not fn.is_valid_instruction(value):
+
+                    if fn.is_valid_instruction(value):
+                        swlbl = ".LC%x-.LC%x" % (value, swbase)
+                    # Switch table entry might refer to the end of function boundary
+                    # Thus, we check whether the value refers to the end of function
+                    elif fn.is_located_at_the_end_of_function(value):
+                        # is_located_at_the_end_of_function() have created .LLCXXX label
+                        swlbl = ".LLC%x-.LC%x" % (value, swbase)
+                    else:
                         break
 
-                    swlbl = ".LC%x-.LC%x" % (value, swbase)
                     rodata.replace(slot, 4, swlbl)
 
     def _adjust_target(self, container, target):