search

angr / simuvex

[DEPRECATED] A symbolic execution engine for the VEX IR
BSD 2-Clause "Simplified" License
79 stars 57 forks source link

bnd retn not supported #98

Closed bannsec closed 7 years ago

bannsec commented 7 years ago

Making a brief detour into windows land i found errors when running the binary that related to an instruction not supported:

In [7]: pg.errored[0].error
Out[7]: angr.errors.AngrExitError('IR decoding error at 0x401d24. You can hook this instruction with a python replacement using project.hook(0x401d24, your_function, length=length_of_instruction).')

Turns out the command was bnd retn. Bytes as \xf2\xc3

ltfish commented 7 years ago

What is bnd retn? I've never seen it.

bannsec commented 7 years ago

Yeah me neither, and I can't find any info on googles. Perhaps it's something specific w/ Microsoft VisualC 14 runtime?

Attaching the file. Angr is having problems decoding instruction at 0x401d24. challenge1.zip

schieb commented 7 years ago

Looks like it is part of a relatively new instruction set extension called MPX (Memory Protection Extensions).

See here and here (§16.1) for details.

ltfish commented 7 years ago

@schieb Thanks! I don't think we will support it before VEX supports it.

rhelmot commented 7 years ago

So it looks like that instruction set extension hijacked the REPNE prefix - F2 is usually REPNE. Apparently using REPNE RETN is identical to a typical return, except that it fixes some issues with the branch predictor on AMD CPUs.

I have implemented this in a recent commit :)