bitdefender / bddisasm

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.
Apache License 2.0
874 stars 112 forks source link

False positive decoding: PCOMMIT #26

Closed woodruffw closed 3 years ago

woodruffw commented 3 years ago

Similar to #22 et al.: PCOMMIT was never introduced in any real x86 hardware. Intel specified it and made compiler changes, but every real x86 CPU will emit an #UD when given a PCOMMIT instruction sequence.

This should probably be either removed or feature-gated behind a flag.

Example:

676626650faef9 (0 / 0) (0 / 0) PCOMMIT (7 / 7)

Resources:

https://software.intel.com/content/www/us/en/develop/blogs/deprecate-pcommit-instruction.html