Displaying 1 result from an estimated 1 matches for "pmentry".
Did you mean:
vmentry
2009 Apr 27
3
Question about vk_check and rllunpack
...new shuffler actually work" (0d8c3d040d9f733f95384f2d5e46609f73bd9c78)
rllunpack in rllpack.inc looks like:
;
; rllunpack:
; Unpack bytes from SI into EDI
; On return (E)SI, EDI are updated and
; (E)CX contains number of bytes output.
;
rllunpack:
push word .pmentry
call simple_pm_call
ret
bits 32
.pmentry:
push edi
movzx esi,si
xor ecx,ecx
It looks to me like rllunpack does trash esi value (upper part), the check at vk_check.scan succeeds
and we jump to vk_check....