search

bitdefender / bddisasm

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.
Apache License 2.0
888 stars 115 forks source link

SHR edx, 0x03 ,SHL al, 0x02 #63

Closed icyfox168168 closed 2 years ago

icyfox168168 commented 2 years ago

long long asmadc2() { long long ret = 0; __asm { push 0xa47 popf mov rdx, 0x000000000000ccdc SHR edx, 0x03 pushf pop rax mov ret, rax

}

if (_bittest64((LONG64*)&ret, RFLAG_OF))
{
    ret = 0x99;
}
else
{
    ret = 0x98;
}

return ret;

}

long long asmadc() { long long ret = 0; __asm { push 0xa03 popf mov rax, 0x000000000000339b SHL al, 0x02 pushf pop rax mov ret, rax

}

if (_bittest64((LONG64*)&ret, RFLAG_OF))
{
    ret = 0x99;
}
else
{
    ret = 0x98;
}

return ret;

}

icyfox168168 commented 2 years ago

"\x55\x50\x48\x89\xE5\x48\xC7\x45\x00\x00\x00\x00\x00\x68\x03\x0A\x00\x00\x9D\x48\xC7\xC0\x9B\x33\x00\x00\xC0\xE0\x02\x9C\x58\x48\x89\x45\x00\x48\x89\xE8\xB9\x0B\x00\x00\x00\x48\x0F\xA3\x08\xB8\x99\x00\x00\x00\x48\x83\xD0\xFF\x48\x83\xC4\x08\x5D\xC3"

icyfox168168 commented 2 years ago

"\x55\x50\x48\x89\xE5\x48\xC7\x45\x00\x00\x00\x00\x00\x68\x47\x0A\x00\x00\x9D\x48\xC7\xC2\xDC\xCC\x00\x00\xC1\xEA\x03\x9C\x58\x48\x89\x45\x00\x48\x89\xE8\xB9\x0B\x00\x00\x00\x48\x0F\xA3\x08\xB8\x99\x00\x00\x00\x48\x83\xD0\xFF\x48\x83\xC4\x08\x5D\xC3"

icyfox168168 commented 2 years ago

long long asmadc() { long long ret = 0; __asm { push 0x246 popf mov rcx, 0x0000e28b5d4df701 ROL rcx, 0x10 pushf pop rax mov ret, rax

}

if (_bittest64((LONG64*)&ret, RFLAG_OF))
{
    ret = 0x99;
}
else
{
    ret = 0x98;
}

return ret;

}

"\x55\x50\x48\x89\xE5\x48\xC7\x45\x00\x00\x00\x00\x00\x68\x46\x02\x00\x00\x9D\x48\xB9\x01\xF7\x4D\x5D\x8B\xE2\x00\x00\x48\xC1\xC1\x10\x9C\x58\x48\x89\x45\x00\x48\x89\xE8\xB9\x0B\x00\x00\x00\x48\x0F\xA3\x08\xB8\x99\x00\x00\x00\x48\x83\xD0\xFF\x48\x83\xC4\x08\x5D\xC3"

vlutas commented 2 years ago

FaD. According to the Intel SDM, Vol. 2B, sections 4.531 and 4.601, the OF is undefined for RCL/RCR/ROL/ROR and SAL/SAR/SHL/SHR operations with a rotate/shift count larger than 1.