Bengaly
April 9th, 2009, 06:39
I'm testing and adding / fixing correct disassembly in my pvdasm engine, and lately i've found out that all disassemblers are have problems decoding this (And i guess some others which I have not yet investigated) opcodes:
consider the following bytes:
IDA:
OllyDbg:
PVDasm
WinDbg
shows different results too
As you can see, Ollydbg cannot decode the 0xF3 prefix, however, check out the next two instructions.. they are completely different (from IDA, and look alike PVDasm and WinDBg), Now, logically, ollydbg/PVDasm/WinDbg..etc, as appose to IDA, follows the ModR/M+SIB (If exists) and perform the decoding according to the opcode's decoding bits.
Intel, sometimes likes to play with their opcodes and force opcode operation, disregarding the bit tables so i guess that may be the reason ?.
Can someone please test those 3 operations (opcodes) on Softice? (don't have it installed here) to see what they come up with? (Maybe bastard or even run it at linux disassembler?)
I just want to know which one is the correct one
consider the following bytes:
IDA:
Code:
F3 0F D6 4C 24 04 movq2dq xmm1, qword ptr [esp+4]
F2 0F D6 04 24 movdq2q mm0, xmm4
F2 0F D6 8F 05 F2 0F D6 movdq2q mm1, xmm7
OllyDbg:
Code:
F3 REP
0F DB 0F ; Unknown command
D6 SALC ;Undocumented instruction or encoding
4C DEC ESP
24 04 AND AL,04
F2 0F D6 04 24 MOVDQ2Q MM0,QWORD PTR SS:[ESP]
F2 0F D6 8F 05 F2 0F D6 MOVDQ2Q MM1,QWORD PTR DS:[EDI+D60FF205]
PVDasm
Code:
F3 0F D6 4C 24 04 MOVQ2DQ XMM1,QWORD PTR SS:[ESP+04]
F2 0F D6 04 24 MOVDQ2Q XMM0,QWORD PTR SS:[ESP] ; wrong register, should be mm0
F2 0F D6 8F 05 F2 0F D6 MOVDQ2Q QWORD PTR DS:[EDI+D60FF205],XMM1 ; bit d is incorrect and wrong register, should be mm1
WinDbg
shows different results too
As you can see, Ollydbg cannot decode the 0xF3 prefix, however, check out the next two instructions.. they are completely different (from IDA, and look alike PVDasm and WinDBg), Now, logically, ollydbg/PVDasm/WinDbg..etc, as appose to IDA, follows the ModR/M+SIB (If exists) and perform the decoding according to the opcode's decoding bits.
Intel, sometimes likes to play with their opcodes and force opcode operation, disregarding the bit tables so i guess that may be the reason ?.
Can someone please test those 3 operations (opcodes) on Softice? (don't have it installed here) to see what they come up with? (Maybe bastard or even run it at linux disassembler?)

I just want to know which one is the correct one
