1
0
mirror of https://github.com/bitdefender/bddisasm.git synced 2024-12-22 22:18:09 +00:00
Commit Graph

14 Commits

Author SHA1 Message Date
BITDEFENDER\vlutas
fe6a937f51 Switched to internally defined types.
WRUSSD and WRUSSQ cannot be executed when CPL != 0.
2022-01-05 14:03:13 +02:00
BITDEFENDER\vlutas
433e723e07 Implemented a reverse oprand lookup table. It holds pointers to relevant operands inside INSTRUX, for quick lookup.
Moved helper functions in bdhelpers.c.
Added a dedicated BranchInfo field inside INSTRUX, containing the most relevant branch information.
2021-11-02 11:22:22 +02:00
Andrei Vlad LUTAS
08096172cc Multiple improvements
- New shemu flag - SHEMU_FLAG_SIDT, set when sheu encounters a SIDT in ring0.
- Added the CET Tracked flag to SYSCLAL, SYSENTER and INT n instructions.
- Fixed Do Not Track prefix recognition for CALL and JMP in long-mode.
- Fixed MONITOR and MONITORX implicit operands - the rAX register encodes a virtual address that will be used as the monitored range. That address is subject to a 1 byte load.
- Fixed RMPADJUST and RMPUPDATE implicit operands - the rAX register encodes a virtual address, and the rCX register encodes a virtual address of the RMP updated entry.
2021-08-31 13:37:50 +03:00
Andrei Vlad LUTAS
f7bf814bbc Flag the rIP operand of conditional branches as being conditionally read/write instead of plain read/write.
Bypass self-writes option in bdshemu - if set, bdshemu will not proceed to commit modifications made by the shellcode to itself.
2021-05-17 09:04:34 +03:00
Andrei Vlad LUTAS
1eb1c9d0d2 Fixed https://github.com/bitdefender/bddisasm/issues/38. 2021-01-15 19:09:53 +02:00
Andrei Vlad LUTAS
e26971b4f0 Added missing Default 64 flag for the ENTER instruction.
On AMD, operand size is never forced to 64 bit - instead, it only defaults to 64 bit, which means that 0x66 can be used to encode 16 bit version of the instructions.
2020-11-06 14:19:22 +02:00
Andrei Vlad LUTAS
9652450125 Added support for UINTR, HRESET and AVX-VNNI instructions, as per Intel® Architecture Instruction Set Extensions Programming Reference 41 (October 2020). 2020-10-05 13:19:03 +03:00
Andrei Vlad LUTAS
24ae7782d6 Fixed some static code check warnings. 2020-09-21 12:16:45 +03:00
Andrei Vlad LUTAS
33078e4670 Added support for TDX instructions, per https://software.intel.com/content/dam/develop/external/us/en/documents/intel-tdx-cpu-architectural-specification.pdf. 2020-09-10 11:06:20 +03:00
Andrei Vlad LUTAS
4b2f2aee66 Added dedicated Prefetch operand access type.
Internally, store the access type sepparately than the flags.
Dump conditional operand accesses with exi option too.
2020-07-25 17:16:35 +03:00
Andrei Vlad LUTAS
752bc626c4 Fixed RET with immediate - the immediate is not sign-extended.
Fixed VEX decoding in 32 bit mode - vex.vvvv bit 3 is simply ignored.
Fixed several FMA instructions decoding (L/W flag should be ignored).
Print the 64 bit immediate value in disassembly, instead of the raw immediate (note that the operand always contains the sign-extended, full immediate).
XBEGIN always uses 32/64 bit RIP size (0x66 does not affect its size).
Decode WBINVD even if it's preceded by 0x66/0xF2 prefixes.
Several mnemonic fixes (FXSAVE64, FXRSTOR64, PUSHA/PUSHAD...).
Properly decode VPERMIL2* instructions.
Fixed SSE register decoding when it is encoded in immediate.
Decode SCATTER instructions even though they use the VSIB index as source.
Some disp8 fixes (t1s -> t1s8/t1s16).
SYSCALL/SYSRET are decoded and executed in 32 bit compat modem, even though SDM states they are invalid.
RDPID uses 32/64 bit reg size, never 16.
Various other minor tweaks & fixes.
Re-generated the test files, and added some more, new tests.
2020-07-23 14:08:01 +03:00
Andrei Vlad LUTAS
94d7894fa5 Added the Shadow Stack Pointer operand to the SYSRET and SYSENTER instructions.
Regenrated CET test files, as the CPUID feature flag was split as per the last documentation into CET_SS and CET_IBT.
2020-07-22 09:15:29 +03:00
Andrei Vlad LUTAS
9ff2543660 Added the Shadow Stack Pointer operand to the SYSCALL and SYSEXIT instructions.
Moved the CET test cases in dedicated folders.
Improved shadow-stack operand reporting - a distinction can be made between push/pop shadow stack accesses, and other shadow stack accesses.
A new field is now present in the memory information - the shadow stack access type, which indicates: explicit access, implicit via SSP, implicit push/pop via SSP or implicit via IA32_PL0_SSP.
2020-07-21 22:29:59 +03:00
Andrei Vlad LUTAS
698ba367a1 Initial commit. 2020-07-21 11:19:18 +03:00