NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
49.09k stars 5.65k forks source link

x86: PUSHF/POPF address size fixes (64-bit mode) #6601

Open Sleigh-InSPECtor opened 1 month ago

Sleigh-InSPECtor commented 1 month ago

The addrsize should be ignored for PUSHF/POPF instructions. This was potentially used before the LONGMODE_ON context bit was introduced to distinguish the 64-bit behavior from the 32-bit behavior. Since addrsize can be manipulated using the address size override prefix, it can cause the wrong PUSHF/POPF size to be decoded. The LONGMODE_ON constraint is now sufficient, so this PR simply removes the unnecessary addrsize constraint.

e.g.,

(Note: on the hardware reference, extra bits that are set correspond to EFLAGS.res1 (bit 1) and EFLAGS.TF (bit 8))


The LONGMODE_OFF constructors have been left alone in this PR, although they technically should also ignore address size overrides. With LONGMODE_OFF, the address size is used to determine whether the segment pcodeop is applied during address translation, however segmentation should still be applied in 32-bit protected mode, but since most users are likely to be working with 32-bit programs where segment bases are all zero, the current behavior probably behaves better than injecting segment ops everywhere.

(It could make sense to introduce pseudo registers like CS.base/DS.base/etc... that are assumed to be zero but are user overridable, like the way the direction flag is handled)