one_gadget 1.9.0 → 2.0.0

data/lib/one_gadget/emulators/conditional.rb

@@ -0,0 +1,348 @@
+# frozen_string_literal: true
+
+require 'one_gadget/error'
+require 'one_gadget/helper'
+
+module OneGadget
+  module Emulators
+    # Shared modelling of compare instructions and conditional branches.
+    #
+    # A gadget candidate may cross a conditional branch: the fetcher stitches the
+    # actual taken/not-taken path (see {OneGadget::Fetchers::Base#candidates}), and
+    # the emulator turns the branch decision into a gadget constraint.
+    #
+    # Branches are resolved with one line of look-ahead: at the branch we record a
+    # pending decision, and on the next line we compare that line's address to the
+    # branch target to learn whether the stitched path took the branch.
+    #
+    # The including class (an {OneGadget::Emulators::Processor} subclass) must
+    # provide +registers+ and +register?+ (operand lookup), +operands(cmd)+ (the
+    # arch's operand splitter), +self.class.bits+ (32/64, for the signedness cast),
+    # and the +@flags+/+@pending+/+@constraints+ state {Processor#initialize} sets up.
+    #
+    # @example A +b.ne+ whose branch is *not* taken becomes the constraint +x2 == 0x1+
+    #   #   c7a4c: cmp  x2, 1
+    #   #   c7a50: b.ne c7a9c    # stitched path falls through (does not jump)
+    #   # => emitted gadget constraint:  x2 == 0x1
+    module Conditional
+      # Taken-semantics of each supported branch condition, keyed by a predicate
+      # named after the comparison it encodes (the LLVM +icmp+ names): a leading
+      # +u+ = unsigned, +s+ = signed. Value is +[relation, signedness]+, where
+      # signedness (+nil+/+:u+/+:s+) selects the operand cast.
+      #   :eq  :ne                equality
+      #   :ult :ule :ugt :uge     unsigned  <  <=  >  >=
+      #   :slt :sle :sgt :sge     signed    <  <=  >  >=
+      RELATION = {
+        eq: ['==', nil], ne: ['!=', nil],
+        ult: ['<', :u], ule: ['<=', :u], ugt: ['>', :u], uge: ['>=', :u],
+        slt: ['<', :s], sle: ['<=', :s], sgt: ['>', :s], sge: ['>=', :s]
+      }.freeze
+
+      # Relation under the not-taken branch.
+      NEGATE = { '==' => '!=', '!=' => '==', '>=' => '<', '<' => '>=', '>' => '<=', '<=' => '>' }.freeze
+
+      # The flag-setting compares we model, keyed by the ALU operation the compare
+      # performs -- its flags reflect that result. Each entry says whether magnitude
+      # conditions (anything beyond +eq+/+ne+) are sound afterwards (+ordered+) and
+      # names the method that renders its constraint text. An arch maps its own
+      # mnemonics onto these ops (its +COMPARES+), so adding an arch needs no change
+      # here; adding a genuinely new ALU op means one entry plus its +render_*+ method.
+      COMPARE_OPS = {
+        sub: { ordered: true,  render: :render_sub },  # subtraction: flags from  lhs - rhs
+        add: { ordered: true,  render: :render_add },  # addition:    flags from  lhs + rhs
+        and: { ordered: false, render: :render_and }   # bitwise AND: flags from  lhs & rhs (zero flag)
+      }.freeze
+
+      # A value comparison's zero literal, always hex. Pointer operands render
+      # +NULL+ (chosen by the arg resolvers); every value-context zero here is
+      # +0x0+, so a bare +0+ (and objdump's arch-specific +#0+ vs +0x0+) never leaks
+      # into a constraint.
+      ZERO = '0x0'
+      private_constant :ZERO
+
+      # Record a compare so a following conditional branch can be rendered.
+      # Normally reached through {#handle_compare}; call it directly only when an
+      # arch models a flag-setting instruction that {#handle_compare} doesn't cover.
+      # @param [Symbol] op The ALU operation the compare performs -- a {COMPARE_OPS}
+      #   key (+:sub+/+:add+/+:and+). Its flags reflect this result, which decides
+      #   both which branch conditions are expressible and how the constraint is
+      #   rendered. Each arch maps its own mnemonics to these ops (their +COMPARES+);
+      #   a new arch adds a {COMPARE_OPS} entry only for a genuinely new operation.
+      # @param [String] lhs Rendered left operand: a register's current value, or an immediate in hex.
+      # @param [String] rhs Rendered right operand.
+      # @return [true]
+      # @example Record +cmp x2, 0x1+ (subtraction), readying the next branch
+      #   record_compare(:sub, '0x1', '0x1') #=> true
+      #   # a following +b.ne+ not taken renders  0x1 == 0x1  (a stripped tautology)
+      def record_compare(op, lhs, rhs)
+        @flags = { op:, lhs:, rhs: }
+        true
+      end
+
+      # Model a compare line: record its two operands' current values under the
+      # compare's ALU op, so a following conditional branch can be rendered.
+      #
+      # Call this from +process!+ when the mnemonic is one of the arch's compares
+      # (its +COMPARES+ maps the mnemonic to the op), *before* dispatching to the
+      # +inst_*+ handlers.
+      # @param [Symbol] op The compare's ALU operation (a {COMPARE_OPS} key), which the
+      #   arch resolves from the mnemonic.
+      # @param [String] cmd Passed to the arch's +operands+ splitter, so it is whatever
+      #   that splitter expects (a full objdump line, or just its operand part).
+      # @return [true]
+      # @example Wiring in an arch's +process!+ (its +COMPARES+ holds the mnemonic map)
+      #   return handle_compare(COMPARES[mnem], cmd) if COMPARES.key?(mnem)
+      # @example What it records for +cmp x2, 1+ (x2 currently 0x30)
+      #   handle_compare(:sub, '4a1c0: cmp x2, 1') #=> true
+      #   # records op :sub, lhs = 0x30, rhs = 0x1, ready for the next branch
+      def handle_compare(op, cmd)
+        lhs, rhs = operands(cmd)
+        record_compare(op, operand_str(lhs), operand_str(rhs))
+      end
+
+      # The mnemonic of an objdump line. Use it at the top of +process!+ to decide
+      # whether a line is a compare or a branch.
+      # @param [String] cmd One objdump line.
+      # @return [String] The mnemonic, or +''+ when the line has none.
+      # @example
+      #   mnemonic('4a1c0: cmp x2, 1')           #=> 'cmp'
+      #   mnemonic('4a1d0: b.ne 4a200 <foo>')    #=> 'b.ne'
+      #   mnemonic('4a1d4: je   4a200')          #=> 'je'
+      #   mnemonic('')                           #=> ''
+      def mnemonic(cmd)
+        cmd[/\A[0-9a-f]+:\s*(\S+)/, 1] || ''
+      end
+
+      # Render an operand for a constraint: a register becomes its current value,
+      # an immediate becomes hex, anything else (a memory operand) stays as-is.
+      # {#handle_compare} uses it on each compare operand; call it yourself only
+      # when writing a bespoke +branch_on_*+ helper.
+      # @param [String] operand A single operand string from a compare/branch line.
+      # @return [String] The rendered operand.
+      # @example (assuming register +x2+ currently holds the immediate +0x1+)
+      #   operand_str('x2')       #=> '0x1'       # a register -> its current value
+      #   operand_str('0x40')     #=> '0x40'      # a hex immediate -> unchanged
+      #   operand_str('16')       #=> '0x10'      # a decimal immediate -> hex
+      #   operand_str('[sp+0x8]') #=> '[sp+0x8]'  # a memory operand -> unchanged
+      def operand_str(operand)
+        if register?(operand)
+          raise Error::ClobberedRegisterError, operand if clobbered?(registers[operand])
+
+          return value_str(registers[operand])
+        end
+
+        OneGadget::Helper.hex(Integer(operand))
+      rescue ArgumentError
+        operand
+      end
+
+      # A value as a constraint reads it: a concrete one in hex, whichever side of
+      # a compare it came from, and anything else as it renders itself.
+      # @param [Object] val The value to render.
+      # @return [String] Its constraint form.
+      # @example value_str(1) #=> '0x1', so a folded register reads like an immediate
+      def value_str(val)
+        val.is_a?(Integer) ? OneGadget::Helper.hex(val) : val.to_s
+      end
+
+      # Register a branch on the last recorded compare's flags, resolved on the next
+      # line. Call it from +handle_branch+; +cond+ is the comparison predicate and
+      # +target+ is the branch's direct destination address.
+      # @param [Symbol] cond The comparison predicate, a {RELATION} key. Each arch
+      #   first maps its own branch mnemonic to it via its adapter table.
+      # @param [Integer] target Destination address of the branch.
+      # @return [true, :fail] +:fail+ (abort the path) when it cannot be expressed
+      #   soundly: no compare was seen, or a magnitude condition follows an
+      #   equality-only compare (a {COMPARE_OPS} op with +ordered: false+).
+      # @example After +cmp x2, #1+, a following +b.ne 4a200+ (arch maps +b.ne+ to +:ne+)
+      #   branch_on_compare(:ne, 0x4a200) #=> true
+      #   # if the stitched path FALLS THROUGH (doesn't reach 0x4a200) the not-taken
+      #   # relation of +:ne+ is emitted:  x2 == 0x1 ; if it jumps there:  x2 != 0x1
+      # @example No preceding compare -> the path is unsound and is aborted
+      #   branch_on_compare(:ne, 0x4a200) #=> :fail   # when @flags is nil
+      def branch_on_compare(cond, target)
+        return :fail if @flags.nil?
+
+        rel = RELATION[cond]
+        return :fail if rel.nil?
+        # A magnitude condition needs a compare whose flags reflect a full ordering
+        # (+:sub+/+:add+); an equality-only compare (+:and+) supports just eq/ne.
+        return :fail unless COMPARE_OPS.fetch(@flags[:op])[:ordered] || %i[eq ne].include?(cond)
+
+        op = @flags[:op]
+        lhs = @flags[:lhs]
+        rhs = @flags[:rhs]
+        @pending = { target:, compare: ->(taken) { compare_triple(op, lhs, rhs, rel, taken) } }
+        true
+      end
+
+      # Register a self-contained branch that tests a register against zero. It carries
+      # its own compare, so no preceding compare is needed. +negate:+ selects the sense:
+      # +false+ branches when the register is zero, +true+ when it isn't.
+      # @param [Integer] target Destination address of the branch.
+      # @param [String] operand The tested register, as the instruction writes it;
+      #   rendered here, so a value the caller cannot reason about stops the path.
+      # @param [Boolean] negate +false+ = branch when it is zero, +true+ = when it isn't.
+      # @example aarch64 +cbz x0, 4a200+ - branch taken when +x0 == 0+
+      #   branch_on_zero(0x4a200, 'x0', negate: false) #=> true
+      #   # fall-through path emits  x0 != 0 ; taken path emits  x0 == 0
+      # @example x86 reuses it for +jrcxz+/+jecxz+/+jcxz+ (always branch-if-zero)
+      #   branch_on_zero(0x4a200, 'rcx', negate: false)
+      def branch_on_zero(target, operand, negate:)
+        reg = operand_str(operand)
+        hit = negate ? '!=' : '==' # taken (not negated) => reg == 0
+        miss = negate ? '==' : '!='
+        @pending = { target:, compare: ->(taken) { [reg, taken ? hit : miss, ZERO] } }
+        true
+      end
+
+      # Register a self-contained branch that tests a single bit of a register: also
+      # carries its own test, so no preceding compare is needed. Renders a bitmask test.
+      # @param [Integer] target Destination address of the branch.
+      # @param [String] operand The tested register, as the instruction writes it (see {#branch_on_zero}).
+      # @param [Integer] bit The bit index being tested.
+      # @param [Boolean] negate +false+ = branch when the bit is zero, +true+ = when it's set.
+      # @example aarch64 +tbz w0, #4, 4a200+ - branch taken when bit 4 of +w0+ is 0
+      #   branch_on_bit(0x4a200, 'w0', 4, negate: false) #=> true
+      #   # taken path emits  (w0 & 0x10) == 0 ; fall-through emits  (w0 & 0x10) != 0
+      def branch_on_bit(target, operand, bit, negate:)
+        reg = operand_str(operand)
+        mask = OneGadget::Helper.hex(1 << bit)
+        hit = negate ? '!=' : '=='
+        miss = negate ? '==' : '!='
+        @pending = { target:, compare: ->(taken) { ["(#{reg} & #{mask})", taken ? hit : miss, ZERO] } }
+        true
+      end
+
+      # Resolve the pending branch using +cmd+'s address: if it equals the branch
+      # target the stitched path took the branch, else it fell through. On
+      # resolution the rendered relation is appended to the gadget's constraints.
+      # Must be called at the top of +process!+ for every line (a no-op when nothing
+      # is pending), so the branch registered on the previous line sees this line's address.
+      # @param [String] cmd The current objdump line.
+      # @example The fixed first line of every arch's +process!+
+      #   def process!(cmd)
+      #     resolve_pending_branch(cmd)
+      #     ...
+      #   end
+      #   # if the previous line did +branch_on_compare(:ne, 0x4a200)+ and this
+      #   # +cmd+ sits at 0x4a200, the branch was taken; otherwise it fell through
+      def resolve_pending_branch(cmd)
+        return if @pending.nil?
+
+        taken = branch_addr(cmd) == @pending[:target]
+        triple = @pending[:compare].call(taken)
+        @pending = nil
+        @constraints << [:cmp, triple]
+        return if satisfiable?(comparisons_on(triple.first))
+
+        raise Error::InfeasiblePathError, "cannot hold together: #{triple.first}"
+      end
+
+      # Every comparison recorded so far on +expr+, the left side as rendered.
+      # Matching on that text is what makes this sound: the renderer substitutes
+      # each register's current value, so two constraints printing the same left
+      # side really are about the same tracked value (and a differing signedness
+      # cast is part of that text, keeping incomparable ones apart).
+      def comparisons_on(expr)
+        @constraints.filter_map { |type, obj| obj if type == :cmp && obj.first == expr }
+      end
+
+      # Whether some value satisfies every comparison in +triples+ at once, by
+      # intersecting the range each one allows. Comparisons against anything but
+      # an integer are ignored rather than guessed at, so an undecidable one never
+      # makes a path look impossible.
+      # @param [Array<(String, String, String)>] triples Comparisons on one expression.
+      # @return [Boolean]
+      # @example  x != 0x0  together with  x == 0x0  #=> false
+      def satisfiable?(triples)
+        low = nil
+        high = nil
+        excluded = []
+        triples.each do |_expr, op, rhs|
+          next unless OneGadget::Helper.integer?(rhs)
+
+          value = Integer(rhs)
+          case op
+          when '=='
+            low = [low, value].compact.max
+            high = [high, value].compact.min
+          when '!=' then excluded << value
+          when '<' then high = [high, value - 1].compact.min
+          when '<=' then high = [high, value].compact.min
+          when '>' then low = [low, value + 1].compact.max
+          when '>=' then low = [low, value].compact.max
+          end
+        end
+        return false if low && high && (low > high || (low == high && excluded.include?(low)))
+
+        true
+      end
+
+      private
+
+      # Render the constraint a taken/not-taken branch imposes on the recorded
+      # compare: flip the operator via {NEGATE} on the not-taken edge, prefix the
+      # signedness cast, then defer to the op's +render_*+ method (see {COMPARE_OPS}).
+      # Raises +KeyError+ if +op+ isn't a known {COMPARE_OPS} entry.
+      # @param [Symbol] op The compare's ALU operation (a {COMPARE_OPS} key).
+      # @param [Array(String, Symbol)] rel The +[operator, signedness]+ from {RELATION}.
+      # @example +b.ne+ (not taken) after +cmp x2, 1+ -- a +:sub+ compare, 64-bit
+      #   compare_constraint(:sub, 'x2', '0x1', ['!=', nil], false) #=> 'x2 == 0x1'
+      # @example +jne+ (taken) after +test eax, eax+ -- an +:and+ compare
+      #   compare_constraint(:and, 'eax', 'eax', ['!=', nil], true) #=> 'eax != 0'
+      def compare_triple(op, lhs, rhs, rel, taken)
+        operator, sign = rel
+        operator = NEGATE[operator] unless taken
+        cast = sign ? "(#{sign}#{self.class.bits})" : ''
+        __send__(COMPARE_OPS.fetch(op)[:render], cast, lhs, rhs, operator, sign)
+      end
+
+      # Subtraction (+:sub+): a direct comparison of the two operands.
+      def render_sub(cast, lhs, rhs, op, _sign)
+        rhs = ZERO if rhs == '0'
+        ["#{cast}#{lhs}", op, rhs]
+      end
+
+      # Addition (+:add+): the flags reflect +lhs + rhs+ compared against 0 -- but
+      # only for a signed or equality condition. An *unsigned* condition reads the
+      # carry out of the addition instead, which holds over a whole range of +lhs+,
+      # not just the one value making the sum zero: the carry is set exactly when
+      # +lhs + rhs+ wraps, i.e. when +lhs >= -rhs+. So the condition is +lhs+
+      # against +-rhs+, the form the subtractive compares already produce.
+      # @example glibc's "the syscall didn't return -errno" check, +cmn x0, 0x1000+
+      #   followed by a not-taken +b.hi+, is +(u64)x0 <= 0xfffffffffffff000+ --
+      #   satisfied by x0 == 0, which "(x0 + 0x1000) <= 0" would wrongly exclude.
+      def render_add(cast, lhs, rhs, op, sign)
+        return ["#{cast}(#{lhs} + #{rhs})", op, ZERO] unless sign == :u && negatable?(rhs)
+
+        ["#{cast}#{lhs}", op, OneGadget::Helper.hex((-Integer(rhs)) & mask)]
+      end
+
+      # Bitwise AND (+:and+): a bitmask test; identical operands collapse to a plain zero test.
+      def render_and(_cast, lhs, rhs, op, _sign)
+        [lhs == rhs ? lhs : "(#{lhs} & #{rhs})", op, ZERO]
+      end
+
+      # Whether +rhs+ can be moved to the other side of an unsigned add-compare.
+      # A zero addend never carries, so the condition doesn't reduce to a bound and
+      # the sum form is kept.
+      def negatable?(rhs)
+        OneGadget::Helper.integer?(rhs) && !Integer(rhs).zero?
+      end
+
+      # All-ones for this architecture's word size.
+      def mask
+        (1 << self.class.bits) - 1
+      end
+
+      # The address of an objdump line, used to tell whether the pending branch
+      # was taken.
+      # @example
+      #   branch_addr('4a200: nop') #=> 0x4a200
+      def branch_addr(cmd)
+        cmd[/\A\s*([0-9a-f]+):/, 1].to_i(16)
+      end
+    end
+  end
+end

data/lib/one_gadget/emulators/i386.rb

@@ -25,8 +25,8 @@ module OneGadget
       # We need to fetch the stack slots reference to current 'esp'
       # but not original 'esp'.
       # So we need to evaluate the offset of current esp first.
-      # @param [Integer] idx
-      # @return [Lambda, Integer]
+      # @param [Integer] idx The 0-based index of the argument.
+      # @return [Lambda, Integer] The value on the stack slot holding the +idx+-th argument.
       def argument(idx)
         cur_top = registers['esp'].evaluate('esp' => 0)
         sp_based_stack[cur_top + idx * 4]

data/lib/one_gadget/emulators/instruction.rb

@@ -24,14 +24,15 @@ module OneGadget
       end
 
       # Extract arguments from command.
-      # @param [String] cmd
-      # @return [Array<String>] Arguments.
+      # @param [String] cmd One line of objdump output containing this instruction.
+      # @return [Array<String>] The instruction's operands, with size hints and comments stripped.
       # @raise [OneGadget::Error::InstructionArgumentError]
+      #   Raised when the number of operands does not match {#argc}.
       def fetch_args(cmd)
         idx = cmd.index(inst)
         cmd = cmd[0...cmd.rindex('//')] if cmd.rindex('//')
         cmd = cmd[0...cmd.rindex('#')] if cmd.rindex('#')
-        args = parse_args(cmd[idx + inst.size..-1])
+        args = parse_args(cmd[idx + inst.size..])
         unless argc.include?(args.size)
           raise OneGadget::Error::InstructionArgumentError, "Incorrect argument number in #{cmd}, expect: #{argc}"
         end
@@ -42,8 +43,8 @@ module OneGadget
       end
 
       # If the command contains this instruction.
-      # @param [String] cmd
-      # @return [Boolean]
+      # @param [String] cmd One line of objdump output.
+      # @return [Boolean] +true+ if +cmd+ contains this instruction's mnemonic.
       def match?(cmd)
         (cmd =~ /#{inst}\s/) != nil
       end

data/lib/one_gadget/emulators/lambda.rb

@@ -14,6 +14,8 @@ module OneGadget
       attr_accessor :obj # @return [String, Lambda] The object currently related to.
       attr_accessor :immi # @return [Integer] The immidiate value currently added.
       attr_accessor :deref_count # @return [Integer] The times of dereference.
+      attr_accessor :op # @return [String, nil] The operator applied to {#obj}, for an operation (see {.operation}).
+      attr_accessor :rhs # @return [Integer, Lambda, String, nil] The operator's right operand.
 
       # Instantiate a {Lambda} object.
       # @param [Lambda, String] obj
@@ -34,6 +36,8 @@ module OneGadget
         else
           ret = Lambda.new(obj)
           ret.immi = immi
+          ret.op = op
+          ret.rhs = rhs
         end
         ret.immi += other
         ret
@@ -43,7 +47,7 @@ module OneGadget
       # @param [Numeric] other Value to substract.
       # @return [Lambda] The result.
       def -(other)
-        self.+(-other)
+        self + -other
       end
 
       # Increase dereference count by 1.
@@ -67,6 +71,8 @@ module OneGadget
       def deref
         ret = Lambda.new(obj)
         ret.immi = immi
+        ret.op = op
+        ret.rhs = rhs
         ret.deref_count = deref_count + 1
         ret
       end
@@ -76,12 +82,45 @@ module OneGadget
       def to_s
         str = ''
         str += '[' * deref_count
-        str += obj.to_s unless obj.nil?
+        str += base_str
         str += OneGadget::Helper.hex(immi, psign: true) unless immi.zero?
         str += ']' * deref_count
         str
       end
 
+      # A value this emulator can name but not fold: an operation applied to
+      # +lhs+, whose result no plain base+offset expresses. Kept as the operation
+      # itself, so a constraint on it still says what the caller has to arrange.
+      # @param [Lambda, String] lhs The left operand.
+      # @param [String] op The operator, as it should render.
+      # @param [Integer, Lambda, String] rhs The right operand.
+      # @return [Lambda]
+      # @example (amd64) +and rax, 0xf+ leaves rax holding +(rax & 0xf)+
+      #   Lambda.operation(registers['rax'], '&', 0xf)
+      def self.operation(lhs, op, rhs)
+        Lambda.new(lhs).tap do |lmda|
+          lmda.op = op
+          lmda.rhs = rhs
+        end
+      end
+
+      # Whether this names an operation rather than a base+offset (see {.operation}).
+      # @return [Boolean]
+      def operation?
+        !op.nil?
+      end
+
+      # What {#to_s} renders before any offset: the operation this names, or the
+      # object it is based on.
+      # @return [String]
+      def base_str
+        return '' if obj.nil?
+        return obj.to_s unless operation?
+
+        rendered = rhs.is_a?(Integer) ? OneGadget::Helper.hex(rhs) : rhs.to_s
+        "(#{obj} #{op} #{rendered})"
+      end
+
       # Evaluates the value of lambda.
       # Only supports +rsp+0x30+ form.
       # @param [Hash{String => Integer}] context
@@ -102,8 +141,9 @@ module OneGadget
       class << self
         # Target: parse string like <tt>[rsp+0x50]</tt> into a {Lambda} object.
         # @param [String] argument
+        #   The instruction operand to parse, e.g. +[rsp+0x50]+ or +rax+0x30+.
         # @param [Hash{String => Lambda}] predefined
-        #   Predefined values.
+        #   Maps register/variable names to known {Lambda} values, used to resolve +argument+'s base.
         # @return [OneGadget::Emulators::Lambda, Integer]
         #   If +argument+ contains numbers only, returns the value.
         #   Otherwise, returns a {Lambda} object.
@@ -116,21 +156,30 @@ module OneGadget
         #   Lambda.parse('[x0, -104]')
         #   #=> #<Lambda @obj='x0', @immi=-104, @deref_count=1>
         def parse(argument, predefined: {})
-          arg = argument.dup
+          arg = argument
           return 0 if arg.empty? || arg == '!'
-          return Integer(arg) if OneGadget::Helper.integer?(arg)
+
+          literal = Integer(arg, exception: false)
+          return literal unless literal.nil?
 
           # nested []
           if arg[0] == '['
             ridx = arg.rindex(']')
-            immi = parse(arg[(ridx + 1)..-1])
-            lm = parse(arg[1...ridx], predefined: predefined).deref
+            immi = parse(arg[(ridx + 1)..])
+            inner = parse(arg[1...ridx], predefined:)
+            # An absolute address (the +[0x1234]+ in +lea rax, [0x1234]+) parses to an Integer;
+            # model it as a based-nowhere Lambda so it can still be dereferenced.
+            inner = Lambda.new(nil).tap { |l| l.immi = inner } if inner.is_a?(Integer)
+            lm = inner.deref
             lm += immi unless immi.zero?
             return lm
           end
 
           base, disp = mem_obj(arg)
-          obj = predefined[base] || Lambda.new(base)
+          obj = predefined[base]
+          # A register may currently hold a call-target string (after a call);
+          # treat that as a fresh symbolic base. Lambda/Integer/xmm-array pass through.
+          obj = Lambda.new(base) if obj.nil? || obj.is_a?(String)
           obj += disp unless disp.zero?
           obj
         end
@@ -143,7 +192,7 @@ module OneGadget
           # 0. reg
           # 1. reg+imm / reg-imm
           # 2. reg, imm / reg, -imm
-          tokens = arg.gsub(/[+\-]/, ' \0').scan(/[+\-\w]+/)
+          tokens = arg.gsub(/[+-]/, ' \0').scan(/[+\-\w]+/)
           return [tokens.first, 0] if tokens.size == 1
           raise Error::UnsupportedInstructionArgumentError, arg unless tokens.size == 2
           raise Error::UnsupportedInstructionArgumentError, arg unless OneGadget::Helper.integer?(tokens.last)