arno/bddisasm
1
0
Fork 0
mirror of https://github.com/bitdefender/bddisasm.git synced 2024-11-18 05:28:09 +00:00
Code Issues Releases Wiki Activity
e3855b464f
bddisasm/bddisasm_test/x86/basic/branch_32.result

834 lines
53 KiB
Plaintext
Raw Normal View History

Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000000 e8fbffffff CALL 0x0
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 4, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000005 66ffd0 CALL ax
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Register, Size: 2, RawSize: 2, Encoding: M, RegType: General Purpose, RegSize: 2, RegId: 0, RegCount: 1
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: -W, Type: Memory, Size: 2, RawSize: 2, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 2, RawSize: 2, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000008 ffd0 CALL eax
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: M, RegType: General Purpose, RegSize: 4, RegId: 0, RegCount: 1
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000000A 67ff17 CALL dword ptr [bx]
DSIZE: 32, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000000D ff13 CALL dword ptr [ebx]
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000000F 66ff13 CALL word ptr [ebx]
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 2, RawSize: 2, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: -W, Type: Memory, Size: 2, RawSize: 2, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 2, RawSize: 2, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000012 ff13 CALL dword ptr [ebx]
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000014 ebfe JMP 0x14
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
0000000000000016 66ffe0 JMP ax
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Register, Size: 2, RawSize: 2, Encoding: M, RegType: General Purpose, RegSize: 2, RegId: 0, RegCount: 1
Operand: 1, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
0000000000000019 ffe0 JMP eax
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: M, RegType: General Purpose, RegSize: 4, RegId: 0, RegCount: 1
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
000000000000001B 67ff27 JMP dword ptr [bx]
DSIZE: 32, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
000000000000001E ff23 JMP dword ptr [ebx]
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
0000000000000020 66ff23 JMP word ptr [ebx]
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 2, RawSize: 2, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
0000000000000023 ff23 JMP dword ptr [ebx]
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: yes
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
0000000000000025 669a00102000 CALLF 0x0020:0x1000
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: no
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Address, Size: 4, RawSize: 4, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 2, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000002B 9a000000102000 CALLF 0x0020:0x10000000
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: no
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Address, Size: 6, RawSize: 6, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 2, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000032 66ea00102000 JMPF 0x0020:0x1000
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: no
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Address, Size: 4, RawSize: 4, Encoding: D
Operand: 1, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
0000000000000038 9a000000102000 CALLF 0x0020:0x10000000
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: no
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Address, Size: 6, RawSize: 6, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 2, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000003F 66ff1b CALLF dword ptr [ebx]
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
Operand: 2, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000042 6667ff1f CALLF dword ptr [bx]
DSIZE: 16, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
Operand: 2, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000046 ff1b CALLF fword ptr [ebx]
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 6, RawSize: 6, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 2, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000048 67ff1f CALLF fword ptr [bx]
DSIZE: 32, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: CALL, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 6, RawSize: 6, Encoding: M,
Segment: 3, Base: 3,
https://github.com/bitdefender/bddisasm/issues/87 - Fixed `CALL` instruction access for `rIP` operand - it must include read access, as the instruction pointer is saved on the stack.
2024-02-26 18:53:42 +00:00
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 2, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000004B 66ff2b JMPF dword ptr [ebx]
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
000000000000004E 6667ff2f JMPF dword ptr [bx]
DSIZE: 16, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
0000000000000052 ff2b JMPF fword ptr [ebx]
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 6, RawSize: 6, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
0000000000000054 67ff2f JMPF fword ptr [bx]
DSIZE: 32, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: UNCOND_BR, CET tracked: yes
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Memory, Size: 6, RawSize: 6, Encoding: M,
Segment: 3, Base: 3,
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
0000000000000057 72fe JC 0x57
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: COND_BR, CET tracked: no
FLAGS access
CF: t,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: yes, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write. Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 06:04:34 +00:00
Operand: 1, Acc: CRCW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
0000000000000059 73fe JNC 0x59
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: COND_BR, CET tracked: no
FLAGS access
CF: t,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: yes, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write. Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 06:04:34 +00:00
Operand: 1, Acc: CRCW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 2, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
000000000000005B e2fe LOOP 0x5b
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: COND_BR, CET tracked: no
FLAGS access
Entire register
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 1, RegCount: 1
Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write. Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 06:04:34 +00:00
Operand: 2, Acc: CRCW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
000000000000005D e0fe LOOPNZ 0x5d
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: COND_BR, CET tracked: no
FLAGS access
ZF: t,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 1, RegCount: 1
Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write. Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 06:04:34 +00:00
Operand: 2, Acc: CRCW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
000000000000005F 67e3fd JCXZ 0x5f
DSIZE: 32, ASIZE: 16, VLEN: -
ISA Set: I86, Ins cat: COND_BR, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Operand: 1, Acc: R-, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: General Purpose, RegSize: 2, RegId: 1, RegCount: 1
Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write. Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 06:04:34 +00:00
Operand: 2, Acc: CRCW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000062 e3fe JECXZ 0x62
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: COND_BR, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Offset, Size: 4, RawSize: 1, Encoding: D
Operand: 1, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 1, RegCount: 1
Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write. Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 06:04:34 +00:00
Operand: 2, Acc: CRCW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000064 cd21 INT 0x21
DSIZE: 32, ASIZE: 32, VLEN: -
Multiple improvements - New shemu flag - SHEMU_FLAG_SIDT, set when sheu encounters a SIDT in ring0. - Added the CET Tracked flag to SYSCLAL, SYSENTER and INT n instructions. - Fixed Do Not Track prefix recognition for CALL and JMP in long-mode. - Fixed MONITOR and MONITORX implicit operands - the rAX register encodes a virtual address that will be used as the monitored range. That address is subject to a 1 byte load. - Fixed RMPADJUST and RMPUPDATE implicit operands - the rAX register encodes a virtual address, and the rCX register encodes a virtual address of the RMP updated entry.
2021-08-31 10:37:50 +00:00
ISA Set: I86, Ins cat: INTERRUPT, CET tracked: yes
Initial commit.
2020-07-21 08:19:18 +00:00
FLAGS access
TF: m, IF: m, NT: m, RF: m, VM: tm, AC: m,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: R-, Type: Immediate, Size: 1, RawSize: 1, Encoding: I
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 2, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 3, Acc: RW, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Operand: 4, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 5, Acc: -W, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000066 cc INT3
DSIZE: 32, ASIZE: 32, VLEN: -
Multiple improvements - New shemu flag - SHEMU_FLAG_SIDT, set when sheu encounters a SIDT in ring0. - Added the CET Tracked flag to SYSCLAL, SYSENTER and INT n instructions. - Fixed Do Not Track prefix recognition for CALL and JMP in long-mode. - Fixed MONITOR and MONITORX implicit operands - the rAX register encodes a virtual address that will be used as the monitored range. That address is subject to a 1 byte load. - Fixed RMPADJUST and RMPUPDATE implicit operands - the rAX register encodes a virtual address, and the rCX register encodes a virtual address of the RMP updated entry.
2021-08-31 10:37:50 +00:00
ISA Set: I86, Ins cat: INTERRUPT, CET tracked: yes
Initial commit.
2020-07-21 08:19:18 +00:00
FLAGS access
TF: m, IF: m, NT: m, RF: m, VM: tm, AC: m,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: RW, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Operand: 3, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000067 f1 INT1
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: INTERRUPT, CET tracked: no
FLAGS access
TF: m, IF: m, NT: m, RF: m, VM: tm, AC: m,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: RW, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Operand: 3, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
0000000000000068 f1 INT1
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: INTERRUPT, CET tracked: no
FLAGS access
TF: m, IF: m, NT: m, RF: m, VM: tm, AC: m,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 1, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: RW, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Operand: 3, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
0000000000000069 c3 RETN
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: RET, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: no
Operand: 0, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 1, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 2, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000006A c22000 RETN 0x0020
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: RET, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: yes, BHINT: no, DNT: no
Fixed RET with immediate - the immediate is not sign-extended. Fixed VEX decoding in 32 bit mode - vex.vvvv bit 3 is simply ignored. Fixed several FMA instructions decoding (L/W flag should be ignored). Print the 64 bit immediate value in disassembly, instead of the raw immediate (note that the operand always contains the sign-extended, full immediate). XBEGIN always uses 32/64 bit RIP size (0x66 does not affect its size). Decode WBINVD even if it's preceded by 0x66/0xF2 prefixes. Several mnemonic fixes (FXSAVE64, FXRSTOR64, PUSHA/PUSHAD...). Properly decode VPERMIL2* instructions. Fixed SSE register decoding when it is encoded in immediate. Decode SCATTER instructions even though they use the VSIB index as source. Some disp8 fixes (t1s -> t1s8/t1s16). SYSCALL/SYSRET are decoded and executed in 32 bit compat modem, even though SDM states they are invalid. RDPID uses 32/64 bit reg size, never 16. Various other minor tweaks & fixes. Re-generated the test files, and added some more, new tests.
2020-07-23 11:08:01 +00:00
Operand: 0, Acc: R-, Type: Immediate, Size: 2, RawSize: 2, Encoding: I
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 4, RegCount: 1
Operand: 3, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: R-, Type: Memory, Size: 4, RawSize: 4, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000006D cb RETF
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: RET, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: R-, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 3, Acc: R-, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
000000000000006E ca2000 RETF 0x0020
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: RET, CET tracked: no
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Fixed RET with immediate - the immediate is not sign-extended. Fixed VEX decoding in 32 bit mode - vex.vvvv bit 3 is simply ignored. Fixed several FMA instructions decoding (L/W flag should be ignored). Print the 64 bit immediate value in disassembly, instead of the raw immediate (note that the operand always contains the sign-extended, full immediate). XBEGIN always uses 32/64 bit RIP size (0x66 does not affect its size). Decode WBINVD even if it's preceded by 0x66/0xF2 prefixes. Several mnemonic fixes (FXSAVE64, FXRSTOR64, PUSHA/PUSHAD...). Properly decode VPERMIL2* instructions. Fixed SSE register decoding when it is encoded in immediate. Decode SCATTER instructions even though they use the VSIB index as source. Some disp8 fixes (t1s -> t1s8/t1s16). SYSCALL/SYSRET are decoded and executed in 32 bit compat modem, even though SDM states they are invalid. RDPID uses 32/64 bit reg size, never 16. Various other minor tweaks & fixes. Re-generated the test files, and added some more, new tests.
2020-07-23 11:08:01 +00:00
Operand: 0, Acc: R-, Type: Immediate, Size: 2, RawSize: 2, Encoding: I
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 3, Acc: R-, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: R-, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000071 66cf IRETW
DSIZE: 16, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: RET, CET tracked: no
FLAGS access
Entire register
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Segment, RegSize: 2, RegId: 1, RegCount: 1
Operand: 1, Acc: -W, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: IP, RegSize: 2, RegId: 0, RegCount: 1
Operand: 2, Acc: R-, Type: Memory, Size: 6, RawSize: 6, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Operand: 3, Acc: RW, Type: Register, Size: 2, RawSize: 2, Encoding: S, RegType: Flags, RegSize: 2, RegId: 0, RegCount: 1
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: RW, Type: Memory, Size: 6, RawSize: 6, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000073 cf IRETD
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: I86, Ins cat: RET, CET tracked: no
FLAGS access
Entire register
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: yes, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 2, Acc: R-, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Stack: yes,
Segment: 2, Base: 4,
Operand: 3, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: RW, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Shadow stack: 3,
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000074 0f34 SYSENTER
DSIZE: 32, ASIZE: 32, VLEN: -
Multiple improvements - New shemu flag - SHEMU_FLAG_SIDT, set when sheu encounters a SIDT in ring0. - Added the CET Tracked flag to SYSCLAL, SYSENTER and INT n instructions. - Fixed Do Not Track prefix recognition for CALL and JMP in long-mode. - Fixed MONITOR and MONITORX implicit operands - the rAX register encodes a virtual address that will be used as the monitored range. That address is subject to a 1 byte load. - Fixed RMPADJUST and RMPUPDATE implicit operands - the rAX register encodes a virtual address, and the rCX register encodes a virtual address of the RMP updated entry.
2021-08-31 10:37:50 +00:00
ISA Set: PPRO, Ins cat: SYSCALL, CET tracked: yes
Initial commit.
2020-07-21 08:19:18 +00:00
CPUID leaf: 0x00000001, reg: edx, bit: 11
FLAGS access
IF: 0,
Valid modes
R0: yes, R1: yes, R2: yes, R3: yes
Real: no, V8086: no, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Fixed some static code check warnings.
2020-09-21 09:16:45 +00:00
Operand: 0, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: Model Specific, RegSize: 8, RegId: 0x00000174, RegCount: 1
Operand: 1, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: Model Specific, RegSize: 8, RegId: 0x00000175, RegCount: 1
Operand: 2, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: Model Specific, RegSize: 8, RegId: 0x00000176, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Operand: 3, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 2, RegCount: 1
Operand: 4, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 4, RegCount: 1
Operand: 5, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 6, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Operand: 7, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Flags, RegSize: 4, RegId: 0, RegCount: 1
Added the Shadow Stack Pointer operand to the SYSRET and SYSENTER instructions. Regenrated CET test files, as the CPUID feature flag was split as per the last documentation into CET_SS and CET_IBT.
2020-07-22 06:15:29 +00:00
Operand: 8, Acc: RW, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: SSP, RegSize: 4, RegId: 0, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
0000000000000076 0f35 SYSEXIT
DSIZE: 32, ASIZE: 32, VLEN: -
ISA Set: PPRO, Ins cat: SYSRET, CET tracked: no
CPUID leaf: 0x00000001, reg: edx, bit: 11
Valid modes
R0: yes, R1: no, R2: no, R3: no
Real: no, V8086: no, Prot: yes, Compat: yes, Long: yes
Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf.
2020-09-10 08:06:20 +00:00
SMM on: yes, SMM off: yes, SGX on: no, SGX off: yes, TSX on: yes, TSX off: yes
VMXRoot: yes, VMXNonRoot: yes, VMXRoot SEAM: yes, VMXNonRoot SEAM: yes, VMX off: yes
Initial commit.
2020-07-21 08:19:18 +00:00
Valid prefixes
REP: no, REPcc: no, LOCK: no
HLE: no, XACQUIRE only: no, XRELEASE only: no
BND: no, BHINT: no, DNT: no
Operand: 0, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 2, RegCount: 1
Operand: 1, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 4, RegCount: 1
Operand: 2, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: Segment, RegSize: 4, RegId: 1, RegCount: 1
Operand: 3, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: IP, RegSize: 4, RegId: 0, RegCount: 1
Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions. Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 19:29:59 +00:00
Operand: 4, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: SSP, RegSize: 4, RegId: 0, RegCount: 1
https://github.com/bitdefender/bddisasm/issues/87 - added missing `R` access for the `rIP` operand for `SYSCALL` instructions; added missing `SCS`, `rCX` and `rDX` operands for `SYSEXIT` instruction.
2024-02-27 07:45:05 +00:00
Operand: 5, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: Model Specific, RegSize: 8, RegId: 0x00000174, RegCount: 1
Operand: 6, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 1, RegCount: 1
Operand: 7, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: S, RegType: General Purpose, RegSize: 4, RegId: 2, RegCount: 1
Initial commit.
2020-07-21 08:19:18 +00:00
Reference in New Issue Copy Permalink