1
0
mirror of https://github.com/bitdefender/bddisasm.git synced 2024-12-01 20:08:09 +00:00
Commit Graph

11 Commits

Author SHA1 Message Date
BITDEFENDER\vlutas
433e723e07 Implemented a reverse oprand lookup table. It holds pointers to relevant operands inside INSTRUX, for quick lookup.
Moved helper functions in bdhelpers.c.
Added a dedicated BranchInfo field inside INSTRUX, containing the most relevant branch information.
2021-11-02 11:22:22 +02:00
Andrei Vlad LUTAS
08096172cc Multiple improvements
- New shemu flag - SHEMU_FLAG_SIDT, set when sheu encounters a SIDT in ring0.
- Added the CET Tracked flag to SYSCLAL, SYSENTER and INT n instructions.
- Fixed Do Not Track prefix recognition for CALL and JMP in long-mode.
- Fixed MONITOR and MONITORX implicit operands - the rAX register encodes a virtual address that will be used as the monitored range. That address is subject to a 1 byte load.
- Fixed RMPADJUST and RMPUPDATE implicit operands - the rAX register encodes a virtual address, and the rCX register encodes a virtual address of the RMP updated entry.
2021-08-31 13:37:50 +03:00
Andrei Vlad LUTAS
f7bf814bbc Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write.
Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 09:04:34 +03:00
Andrei Vlad LUTAS
98ea9e1d9a Fixed https://github.com/bitdefender/bddisasm/issues/34, https://github.com/bitdefender/bddisasm/issues/35, https://github.com/bitdefender/bddisasm/issues/36 and https://github.com/bitdefender/bddisasm/issues/37. 2021-01-11 11:10:04 +02:00
Andrei Vlad LUTAS
bcf9a89d69 Fixed https://github.com/bitdefender/bddisasm/issues/22 and https://github.com/bitdefender/bddisasm/issues/23. 2020-11-08 11:02:46 +02:00
Andrei Vlad LUTAS
2b2dbe2aea D64 flag for ENTER instruction. 2020-11-07 12:12:28 +02:00
Andrei Vlad LUTAS
7a0fa449bc Disassemble 4X90 as NOP as long as Rex.B is 0. Disassemble as XCHG only if Rex.B bit is set (promoting the use of R8 register). 2020-10-09 14:55:39 +03:00
Andrei Vlad LUTAS
d61a6fa5dd * INC/DEC do not modify the CF.
* Fixed FXSAVE64, PUSHAD and POPAD emulation - when explicit mnemonics were added for them, emulation support was not added, thus causing emulation to stop when encountering one of these.
2020-08-19 19:14:22 +03:00
Andrei Vlad LUTAS
752bc626c4 Fixed RET with immediate - the immediate is not sign-extended.
Fixed VEX decoding in 32 bit mode - vex.vvvv bit 3 is simply ignored.
Fixed several FMA instructions decoding (L/W flag should be ignored).
Print the 64 bit immediate value in disassembly, instead of the raw immediate (note that the operand always contains the sign-extended, full immediate).
XBEGIN always uses 32/64 bit RIP size (0x66 does not affect its size).
Decode WBINVD even if it's preceded by 0x66/0xF2 prefixes.
Several mnemonic fixes (FXSAVE64, FXRSTOR64, PUSHA/PUSHAD...).
Properly decode VPERMIL2* instructions.
Fixed SSE register decoding when it is encoded in immediate.
Decode SCATTER instructions even though they use the VSIB index as source.
Some disp8 fixes (t1s -> t1s8/t1s16).
SYSCALL/SYSRET are decoded and executed in 32 bit compat modem, even though SDM states they are invalid.
RDPID uses 32/64 bit reg size, never 16.
Various other minor tweaks & fixes.
Re-generated the test files, and added some more, new tests.
2020-07-23 14:08:01 +03:00
Andrei Vlad LUTAS
811c3d0f7c Fixed several issues with CET instructions specification - shadow stack and shadow stack pointer implicit operands were missing from SETSSBSY instruction, and flags access was missing from them. 2020-07-21 17:36:19 +03:00
Andrei Vlad LUTAS
698ba367a1 Initial commit. 2020-07-21 11:19:18 +03:00