# Test false detection cases. # .text start RVA and end RVA 1000 3000 # .reloc start RVA and end RVA 3800 4000 # End RVA 5000 # Assume ImageBase = 00400000. This does not affect the test. Program: 00401000: 55 push ebp 00401001: 8B EC mov ebp,esp 00401003: B8 E8 00 00 00 mov eax,0E8h # E8 00 00 00 00 00401008: 00 C0 add al,al 0040100A: 90 nop 0040100B: 90 nop 0040100C: B9 00 00 00 E9 mov ecx,0E9000000h # E9 E8 00 00 00 00401011: E8 00 00 00 00 call 00401016 00401016: 90 nop 00401017: 90 nop 00401018: B1 0F mov cl,0Fh # 0F 80 C0 00 00 00 0040101A: 80 C0 00 add al,0 0040101D: 00 00 add byte ptr [eax],al 0040101F: 90 nop 00401020: 90 nop 00401021: B8 E8 00 00 00 mov eax,0E8h # E8 00 00 00 E8 00401026: E8 00 00 00 00 call 0040102B 0040102B: 90 nop 0040102C: 90 nop 0040102D: E8 00 E9 00 00 call 0040F932 # E9 00 00 00 00 00401032: 00 00 add byte ptr [eax],al 00401034: 5D pop ebp 00401035: C3 ret Abs32: Expected: 1005 # False positive 1011 # False positive # 1012 => False negative: shadowed by 1011 101B # False positive # 1023 => Potential false positive, but suppressed since target is outside .text 1027 # Emerges since it's not shadowed by 1023 1030 # False positive: target of 102E was outside .text, so fall back to this