Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mov eax, ds:0x12345678 present in x86_64.xml? #55

Open
NyxCode opened this issue Jun 3, 2024 · 1 comment
Open

mov eax, ds:0x12345678 present in x86_64.xml? #55

NyxCode opened this issue Jun 3, 2024 · 1 comment

Comments

@NyxCode
Copy link

NyxCode commented Jun 3, 2024

Hey! I'm somewhat new to this, but I'm a bit confused digging around in the x86_64.xml. For example, this instruction

    <InstructionForm gas-name="movabsl">
      <Operand type="eax" input="false" output="true"/>
      <Operand type="moffs32"/>
      <Encoding>
        <Opcode byte="A1"/>
        <DataOffset size="4" value="#1"/>
      </Encoding>
    </InstructionForm>

which would encode to A1 78 56 34 12 seems to not be valid on x86-64, only on x86.
Am I missing something here?

@NyxCode
Copy link
Author

NyxCode commented Jun 4, 2024

With some help, I was able to figure out what's going on.
This seems to be either a documentation issue or a bug here. The documentation states

Opcodes/opcodes/x86_64.py

Lines 1104 to 1113 in b606dde

class DataOffset:
"""Absolute data offset embedded into instruction encoding.
Only MOV instruction has forms that use direct data offset.
:ivar size: size of the offset in bytes. Possible values are 4 or 8.
:ivar value: value of the offset. Must be a reference to an instruction operand.
The instruction operand has "moffs" type of the matching size.
"""

Either I misunderstood the docs of the size field here, or it's incorrect.
The Intel manual states

The moffs8, moffs16, moffs32, and moffs64 operands specify a simple offset relative to the segment base, where 8, 16, 32, and 64 refer to the size of the data. The address-size attribute of the instruction determines the size of the offset, either 16, 32, or 64 bits.

So on x86-64, the moffs32 offset needs to be 8 bytes, and it's name moffs32 only refers to the size of the data to be MOVed.

Besides that, using a 4byte offset seems possible, but requires an address size override prefix.

So TL;DR: The size field in DataOffset doesn't do what i thought it did.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant