arno/bddisasm
1
0
Fork 0
mirror of https://github.com/bitdefender/bddisasm.git synced 2024-12-01 20:08:09 +00:00
Code Issues Releases Wiki Activity
3e356513cd
bddisasm/bddisasm_test/x86/cet/cet_64.asm

16 lines
901 B
NASM
Raw Normal View History

Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
bits 64
db 0xF3, 0x0F, 0x01, 0x28 ; RSTORSSP [rax]
db 0xF3, 0x0F, 0x01, 0xEA ; SAVEPREVSSP
db 0xF3, 0x0F, 0x01, 0xE8 ; SETSSBSY
db 0xF3, 0x0F, 0x1E, 0xC8 ; RDSSPD eax
db 0xF3, 0x48, 0x0F, 0x1E, 0xC8 ; RDSSPD rax
db 0xF3, 0x0F, 0x1E, 0xFA ; ENDBR64
db 0xF3, 0x0F, 0x1E, 0xFB ; ENDBR32
db 0xF3, 0x0F, 0xAE, 0x30 ; CLRSSBSY [rax]
db 0xF3, 0x0F, 0xAE, 0xE8 ; INCSSPD eax
db 0xF3, 0x48, 0x0F, 0xAE, 0xE8 ; INCSSPQ rax
db 0x66, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSD [rax], eax
db 0x66, 0x48, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSQ [rax], eax
db 0x0F, 0x38, 0xF6, 0x00 ; WRSSD [rax], eax
db 0x48, 0x0F, 0x38, 0xF6, 0x00 ; WRSSQ [rax], eax
Reference in New Issue Copy Permalink