Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Useless memory access - bt, bts, btr, btc #9

Open
mfaerevaag opened this issue Aug 22, 2017 · 0 comments
Open

Useless memory access - bt, bts, btr, btc #9

mfaerevaag opened this issue Aug 22, 2017 · 0 comments

Comments

@mfaerevaag
Copy link
Collaborator

mfaerevaag commented Aug 22, 2017

Description

Using some seemingly useless memory for simple register operation with operands 0x0c and 0xc8.

CF <- Bit(Bitcase, BitOffset)

Reference:
Ref. Intel 64 and IA-32 Architecture Software Developer's Manual Vol. 2A 3-113

Affected instructions:

0x0fa3c0    # bt
0x0fa3c8
0x0fabc0    # bts
0x0fabc8
0x0fb3c0    # btr
0x0fb3c8
0x0fbbc0    # btc
0x0fbbc8

NOTE: All combinations of prefixes are omitted.

Reproduction guide

Instruction:

00000000  0FA3C0            bt eax,eax

Input:

pyvex.IRSB("\x0F\xA3\xC0", 0x8048000, archinfo.ArchX86())

Observed output:

IRSB {
   t0:Ity_I8 t1:Ity_I8 t2:Ity_I32 t3:Ity_I32 t4:Ity_I8 t5:Ity_I32 t6:Ity_I32 t7:Ity_I32 t8:Ity_I32 t9:Ity_I32 t10:Ity_I32 t11:Ity_I32 t12:Ity_I32 t13:Ity_I8 t14:Ity_I32 t15:Ity_I32 t16:Ity_I32 t17:Ity_I32 t18:Ity_I32 t19:Ity_I32 t20:Ity_I32

   00 | ------ IMark(0x0, 3, 0) ------
   01 | t2 = GET:I32(eax)
   02 | t9 = GET:I32(esp)
   03 | t8 = Sub32(t9,0x00000080)
   04 | PUT(esp) = t8
   05 | STle(t8) = t2
   06 | t3 = And32(t2,0x0000001f)
   07 | t12 = Sar32(t3,0x03)
   08 | t11 = Add32(t8,t12)
   09 | t14 = And32(t3,0x00000007)
   10 | t13 = 32to8(t14)
   11 | t0 = LDle:I8(t11)
   12 | PUT(cc_op) = 0x00000000
   13 | PUT(cc_dep2) = 0x00000000
   14 | t17 = 8Uto32(t0)
   15 | t16 = Shr32(t17,t13)
   16 | t15 = And32(t16,0x00000001)
   17 | PUT(cc_dep1) = t15
   18 | PUT(cc_ndep) = 0x00000000
   19 | t18 = LDle:I32(t8)
   20 | PUT(eax) = t18
   21 | t19 = Add32(t8,0x00000080)
   22 | PUT(esp) = t19
   NEXT: PUT(eip) = 0x00000003; Ijk_Boring
}

Expected output:
Not using useless memory.

System Info

OS:

# uname -a
Linux ubuntu 4.10.0-28-generic #32-Ubuntu SMP Fri Jun 30 05:32:18 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=17.04
DISTRIB_CODENAME=zesty
DISTRIB_DESCRIPTION="Ubuntu 17.04"

PyVEX:

#  pip freeze | grep pyvex
pyvex==6.7.4.12
@soomin-kim soomin-kim changed the title Useless memory - bt, bts, btr, btc Useless memory access - bt, bts, btr, btc Sep 13, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant