capstone-engine / capstone

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
http://www.capstone-engine.org
7.61k stars 1.56k forks source link

Incorrect/Missing Python Binding for operands within the X86-64 STOS Instruction #2305

Open LMS57 opened 7 months ago

LMS57 commented 7 months ago

Work environment

Questions Answers
OS/arch/bits Debian X86 64
Architecture X86-64
Source of Capstone Python Pip Release
Version/git commit v5.0.1

Problem

Appears that there is missing or incorrect information when attempting to grab the register memory base from an operand within the STOS instruction in X86-64. This was found to exist within version 5.0.1 in the Python pip release version. This appears to have appeared since version v5.0.0 commit 34749cf6b2c9dfc. (That is not release version but just the version I happened to have compiled for easy testing). The expected behavior is below from the v5.0.0 test. The actual results from the v5.0.1 test shows that the instruction base value is now returning 0 instead of 39 for the needed registers.

Expected

5.0.0
<CsInsn 0x0 [f348ab]: rep stosq qword ptr [rdi], rax>
op_count: 2
39
0
<CsInsn 0x0 [48ab]: stosq qword ptr [rdi], rax>
op_count: 2
39
0
<CsInsn 0x0 [ab]: stosd dword ptr [rdi], eax>
op_count: 2
39
0

Actual behavior

5.0.1
<CsInsn 0x0 [f348ab]: rep stosq qword ptr [rdi], rax>
op_count: 2
0
0
<CsInsn 0x0 [48ab]: stosq qword ptr [rdi], rax>
op_count: 2
0
0
<CsInsn 0x0 [ab]: stosd dword ptr [rdi], eax>
op_count: 2
0
0

Code used for Testing

import capstone
from capstone import *

print(capstone.__version__)

code = [b'\xf3\x48\xab', b'\x48\xab', b'\xab']
'''
0:  f3 48 ab                rep stos QWORD PTR es:[rdi],rax
3:  48 ab                   stos   QWORD PTR es:[rdi],rax
5:  ab                      stos   DWORD PTR es:[rdi],eax
'''

if __name__ == '__main__':

    md = Cs(CS_ARCH_X86, CS_MODE_64)
    md.detail = True
    for c in code:
        for insn in md.disasm(c, 0):
            print(insn)
            print("op_count: %u" % len(insn.operands))
            for x in insn.operands:
                print(x.mem.base)