Moved the CET test cases in dedicated folders. Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses. A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.pull/1/head
parent
811c3d0f7c
commit
9ff2543660
Binary file not shown.
@ -1,13 +0,0 @@
|
||||
bits 64
|
||||
|
||||
db 0xF3, 0x0F, 0x01, 0x28 ; RSTORSSP qword ptr [rax]
|
||||
db 0xF3, 0x0F, 0x01, 0xEA ; SAVEPREVSSP
|
||||
db 0xF3, 0x0F, 0x01, 0xE8 ; SETSSBSY
|
||||
db 0xF3, 0x0F, 0x1E, 0xC8 ; RDSSPD eax
|
||||
db 0xF3, 0x48, 0x0F, 0x1E, 0xC8 ; RDSSPQ rax
|
||||
db 0xF3, 0x0F, 0x1E, 0xFA ; ENDBR32
|
||||
db 0xF3, 0x0F, 0x1E, 0xFB ; ENDBR64
|
||||
db 0x66, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSD dword ptr [rax], eax
|
||||
db 0x66, 0x48, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSQ dword ptr [rax], rax
|
||||
db 0x0F, 0x38, 0xF6, 0x00 ; WRSSD dword ptr [rax], eax
|
||||
db 0x48, 0x0F, 0x38, 0xF6, 0x00 ; WRSSQ dword ptr [rax], rax
|
Binary file not shown.
@ -0,0 +1,12 @@
|
||||
bits 32
|
||||
|
||||
db 0xF3, 0x0F, 0x01, 0x28 ; RSTORSSP [eax]
|
||||
db 0xF3, 0x0F, 0x01, 0xEA ; SAVEPREVSSP
|
||||
db 0xF3, 0x0F, 0x01, 0xE8 ; SETSSBSY
|
||||
db 0xF3, 0x0F, 0x1E, 0xC8 ; RDSSPD eax
|
||||
db 0xF3, 0x0F, 0x1E, 0xFA ; ENDBR64
|
||||
db 0xF3, 0x0F, 0x1E, 0xFB ; ENDBR32
|
||||
db 0xF3, 0x0F, 0xAE, 0x30 ; CLRSSBSY [rax]
|
||||
db 0xF3, 0x0F, 0xAE, 0xE8 ; INCSSPD eax
|
||||
db 0x66, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSD [rax], eax
|
||||
db 0x0F, 0x38, 0xF6, 0x00 ; WRSSD [rax], eax
|
Binary file not shown.
@ -0,0 +1,16 @@
|
||||
bits 64
|
||||
|
||||
db 0xF3, 0x0F, 0x01, 0x28 ; RSTORSSP [rax]
|
||||
db 0xF3, 0x0F, 0x01, 0xEA ; SAVEPREVSSP
|
||||
db 0xF3, 0x0F, 0x01, 0xE8 ; SETSSBSY
|
||||
db 0xF3, 0x0F, 0x1E, 0xC8 ; RDSSPD eax
|
||||
db 0xF3, 0x48, 0x0F, 0x1E, 0xC8 ; RDSSPD rax
|
||||
db 0xF3, 0x0F, 0x1E, 0xFA ; ENDBR64
|
||||
db 0xF3, 0x0F, 0x1E, 0xFB ; ENDBR32
|
||||
db 0xF3, 0x0F, 0xAE, 0x30 ; CLRSSBSY [rax]
|
||||
db 0xF3, 0x0F, 0xAE, 0xE8 ; INCSSPD eax
|
||||
db 0xF3, 0x48, 0x0F, 0xAE, 0xE8 ; INCSSPQ rax
|
||||
db 0x66, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSD [rax], eax
|
||||
db 0x66, 0x48, 0x0F, 0x38, 0xF5, 0x00 ; WRUSSQ [rax], eax
|
||||
db 0x0F, 0x38, 0xF6, 0x00 ; WRSSD [rax], eax
|
||||
db 0x48, 0x0F, 0x38, 0xF6, 0x00 ; WRSSQ [rax], eax
|
@ -0,0 +1,218 @@
|
||||
0000000000000000 f30f0128 RSTORSSP qword ptr [rax]
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: RW, Type: Memory, Size: 8, RawSize: 8, Encoding: M, Shadow stack: 1,
|
||||
Segment: 3, Base: 0,
|
||||
Operand: 1, Acc: RW, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000004 f30f01ea SAVEPREVSSP
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: RW, Type: Memory, Size: 12, RawSize: 12, Encoding: S, Shadow stack: 2,
|
||||
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000008 f30f01e8 SETSSBSY
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: RW, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 4,
|
||||
|
||||
Operand: 1, Acc: RW, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
000000000000000C f30f1ec8 RDSSPD eax
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: -W, Type: Register, Size: 4, RawSize: 4, Encoding: M, RegType: General Purpose, RegSize: 4, RegId: 0, RegCount: 1
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000010 f3480f1ec8 RDSSPQ rax
|
||||
DSIZE: 64, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: -W, Type: Register, Size: 8, RawSize: 8, Encoding: M, RegType: General Purpose, RegSize: 8, RegId: 0, RegCount: 1
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000015 f30f1efa ENDBR64
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
|
||||
0000000000000019 f30f1efb ENDBR32
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
|
||||
000000000000001D f30fae30 CLRSSBSY qword ptr [rax]
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: RW, Type: Memory, Size: 8, RawSize: 8, Encoding: M, Shadow stack: 1,
|
||||
Segment: 3, Base: 0,
|
||||
Operand: 1, Acc: RW, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000021 f30faee8 INCSSPD eax
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: M, RegType: General Purpose, RegSize: 4, RegId: 0, RegCount: 1
|
||||
Operand: 1, Acc: R-, Type: Memory, Size: 8, RawSize: 8, Encoding: S, Shadow stack: 2,
|
||||
|
||||
Operand: 2, Acc: RW, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000025 f3480faee8 INCSSPQ rax
|
||||
DSIZE: 64, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: M, RegType: General Purpose, RegSize: 8, RegId: 0, RegCount: 1
|
||||
Operand: 1, Acc: R-, Type: Memory, Size: 16, RawSize: 16, Encoding: S, Shadow stack: 2,
|
||||
|
||||
Operand: 2, Acc: RW, Type: Register, Size: 8, RawSize: 8, Encoding: S, RegType: SSP, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
000000000000002A 660f38f500 WRUSSD dword ptr [rax], eax
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: M, Shadow stack: 1,
|
||||
Segment: 3, Base: 0,
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: R, RegType: General Purpose, RegSize: 4, RegId: 0, RegCount: 1
|
||||
|
||||
000000000000002F 66480f38f500 WRUSSQ qword ptr [rax], rax
|
||||
DSIZE: 64, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: M, Shadow stack: 1,
|
||||
Segment: 3, Base: 0,
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: R, RegType: General Purpose, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000035 0f38f600 WRSSD dword ptr [rax], eax
|
||||
DSIZE: 32, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: -W, Type: Memory, Size: 4, RawSize: 4, Encoding: M, Shadow stack: 1,
|
||||
Segment: 3, Base: 0,
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 4, RawSize: 4, Encoding: R, RegType: General Purpose, RegSize: 4, RegId: 0, RegCount: 1
|
||||
|
||||
0000000000000039 480f38f600 WRSSQ qword ptr [rax], rax
|
||||
DSIZE: 64, ASIZE: 64, VLEN: -
|
||||
ISA Set: CET, Ins cat: CET, CET tracked: no
|
||||
CPUID leaf: 0x00000007, sub-leaf: 0x00000000, reg: ecx, bit: 7
|
||||
Valid modes
|
||||
R0: yes, R1: yes, R2: yes, R3: yes
|
||||
Real: yes, V8086: yes, Prot: yes, Compat: yes, Long: yes
|
||||
SMM: yes, SGX: yes, TSX: yes, VMXRoot: yes, VMXNonRoot: yes
|
||||
Valid prefixes
|
||||
REP: no, REPcc: no, LOCK: no
|
||||
HLE: no, XACQUIRE only: no, XRELEASE only: no
|
||||
BND: no, BHINT: no, DNT: no
|
||||
Operand: 0, Acc: -W, Type: Memory, Size: 8, RawSize: 8, Encoding: M, Shadow stack: 1,
|
||||
Segment: 3, Base: 0,
|
||||
Operand: 1, Acc: R-, Type: Register, Size: 8, RawSize: 8, Encoding: R, RegType: General Purpose, RegSize: 8, RegId: 0, RegCount: 1
|
||||
|