False-positive decoding on AMD64: PFRCPV

bitdefender / bddisasm

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.

Apache License 2.0

887 stars 115 forks source link

False-positive decoding on AMD64: PFRCPV #36

Closed woodruffw closed 3 years ago

woodruffw commented 3 years ago

Similar to #23: f22e0f0f5ec586 decodes as PFRCPV mm3, qword ptr [rsi-0x3b], despite being a 16/32-bit only instruction that only appears on very old AMD CPUs.

f22e0f0f5ec586	(0 / 0)	(0 / 0)	(0 / 0)	PFRCPV mm3, qword ptr [rsi-0x3b] (7 / 32)	(0 / 0)

vlutas commented 3 years ago

Fixed in https://github.com/bitdefender/bddisasm/commit/98ea9e1d9a74b5e6ed050d2356cceefbc18462d4