[docs]defresolve(# pylint:disable=unused-argumentself,cfg,addr,func_addr,block,jumpkind,func_graph_complete:bool=True,**kwargs):# Find the address and size of the last instructionlast_insn_addr=Nonelast_insn_size=Noneforstmtinreversed(block.statements):ifisinstance(stmt,IMark):last_insn_addr=stmt.addrlast_insn_size=stmt.lenbreakiflast_insn_addrisNone:# Cannot find the last instructionreturnFalse,[]# lift one instructioninsn=self.project.factory.block(last_insn_addr,size=last_insn_size).capstone.insns[-1]opnd=insn.insn.operands[0]# Must be of the form: call [rip + 0xABCD]ifnot(opnd.memandopnd.mem.dispandopnd.mem.base==X86_REG_RIPandnotopnd.mem.index):returnFalse,[]disp=insn.insn.dispslot=disp+insn.address+insn.sizetarget=cfg._fast_memory_load_pointer(slot)iftargetisNone:l.warning("Address %# is not mapped.",slot)returnFalse,[]ifself.project.loader.find_symbol(target):returnTrue,[target]ifnotself.project.is_hooked(target):returnFalse,[]dest=self.project.hooked_by(target)l.debug("Resolved target to %s",dest.display_name)returnTrue,[target]