Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect stack adjustment size when decoding "push r16" in x86 (32bit) mode #319

Open
xusheng6 opened this issue Jan 22, 2024 · 0 comments
Labels

Comments

@xusheng6
Copy link

For instruciton "push bx" (6653), when xed decodes it in 32bit mode, the stack adjustment is reported as 32bits (4 bytes).

See ASZ0=32 in the following output:

$ obj/wkit/examples/obj/xed-ex1 6653
Attempting to decode: 66 53 
iclass PUSH	category PUSH	ISA-extension BASE	ISA-set I86
instruction-length 2
operand-width 16
effective-operand-width 16
effective-address-width 32
stack-address-width 32
iform-enum-name PUSH_GPRv_50
iform-enum-name-dispatch (zero based) 4
iclass-max-iform-dispatch 11
Nominal opcode position 1
Nominal opcode 0x53
Operands
#   TYPE               DETAILS        VIS  RW       OC2 BITS BYTES NELEM ELEMSZ   ELEMTYPE   REGCLASS
#   ====               =======        ===  ==       === ==== ===== ===== ======   ========   ========
0   REG0               REG0=BX   EXPLICIT   R         V   16     2     1     16        INT        GPR
1   REG1        REG1=STACKPUSH SUPPRESSED  RW       SPW   16     2     1     16        INT     PSEUDO
2   MEM0           (see below) SUPPRESSED   W       SPW   16     2     1     16        INT    INVALID
3  BASE0             BASE0=ESP SUPPRESSED  RW       SSZ   32     4     1     32        INT        GPR
Memory Operands
  0 written SEG= SS BASE= ESP/GPR  ASZ0=32
  MemopBytes = 2
ATTRIBUTES: FIXED_BASE0 SCALABLE STACKPUSH0 
66-OSZ PREFIX
ANY 66 PREFIX
Number of legacy prefixes: 1 
ISA SET: [I86]

However, this is wrong. I used a debugger to verify the stack adjustment is actually 2 bytes, not 4 bytes. This is now causing the downstream lifting error in the Binary NInja x86 arch plugin: Vector35/binaryninja-api#4028.

FYI, this is how we are handling the lifting of the push instruction: https://github.com/Vector35/arch-x86/blob/ce54c270537a36255608cd1f67df64f971558d0e/il.cpp#L2829-L2844. xed_decoded_inst_get_memop_address_width is reporting 32 where I believe it should return 16

@marjevan marjevan added upcoming release A fix/support will be available with the upcoming external release and removed upcoming release A fix/support will be available with the upcoming external release labels Apr 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants