| commit | dba0a4f56891f5ae344109c309fa97d119d19214 | [log] [tgz] |
|---|---|---|
| author | Tim Haines <thaines.astro@gmail.com> | Wed Oct 15 09:40:04 2025 -0500 |
| committer | GitHub <noreply@github.com> | Wed Oct 15 14:40:04 2025 +0000 |
| tree | 282e75ee7f10d402d6e041cde4b8e86ccabc25c3 | |
| parent | 0b61957dd75b937c7acb30f1c48d3c3f8fef2a2a [diff] |
Update read/written registers for x86 string instructions (#2790) * stosb/w/d/q stosq only reads/writes rcx when there is a rep prefix. With regard to reading 'es' in 64-bit mode, the SDM says for stosd For legacy mode, store EAX at address ES:(E)DI; For 64-bit mode store EAX at address RDI or EDI. * lodsb/w/d/q With regard to reading 'ds' in 64-bit mode, the SDM says for lodsd For legacy mode, Load dword at address DS:(E)SI into EAX. For 64-bit mode load dword at address (R)SI into EAX. * scasb/w/d/q X86_REG_ES was removed from the explicit set of read registers because it was causing duplicate entries in 'detail->regs_read'. With regard to reading 'es' in 64-bit mode, the SDM says for scasd Compare EAX with doubleword at ES:(E)DI or RDI then set status flags. * cmpsb/w/d/q The 'es' register is implicitly handled correctly. The 'ds' register should only be read from in 16- and 32-bit mode. From the SDM for cmpsd: For legacy mode, compare dword at address DS:(E)SI with dword at address ES:(E)DI; For 64-bit mode compare dword at address (R|E)SI with dword at address (R|E)DI. The status flags are set accordingly. * movsb/w/d/q The 'es' register is implicitly handled correctly. The 'ds' register should only be read from in 16- and 32-bit mode. From the SDM for movsd: For legacy mode, move dword from address DS:(E)SI to ES:(E)DI. For 64-bit mode move dword from address (R|E)SI to (R|E)DI. * insb/w/d/q X86_REG_EDI was removed from the explicit set of read registers because it was causing duplicate entries in 'detail->regs_read'. The 'ds' register should only be read from in 16- and 32-bit mode. From the SDM for insd: Input doubleword from I/O port specified in DX into memory location specified in ES:(E)DI or RDI. * outsb/w/d/q The 'ds' register should only be read from in 16- and 32-bit mode. From the SDM for outsd: Output word from memory location specified in DS:(E)SI or RSI to I/O port specified in DX.
Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.
Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features:
Support multiple hardware architectures: ARM, AArch64, Alpha, ARC, BPF, Ethereum VM, LoongArch, HP PA-RISC (HPPA), M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86 (16, 32, 64), Xtensa.
Having clean/simple/lightweight/intuitive architecture-neutral API.
Provide details on disassembled instruction (called “decomposer” by others).
Provide semantics of the disassembled instruction, such as list of implicit registers read & written.
Implemented in pure C language, with lightweight bindings for Swift, D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala ready either in main code, or provided externally by the community).
Native support for all popular platforms: Windows, Mac OSX, iOS, Android, Linux, *BSD, Solaris, etc.
Thread-safe by design.
Special support for embedding into firmware or OS kernel.
High performance & suitable for malware analysis (capable of handling various X86 malware tricks).
Distributed under the open source BSD license.
Further information is available at https://www.capstone-engine.org
See BUILDING.md file for how to compile and install Capstone.
See CONTRIBUTING.md for an intro.
See suite/fuzz/README.md for more information.
This project is released under the BSD license. If you redistribute the binary or source code of Capstone, please attach file LICENSE.TXT with your products.