search

capstone-engine / capstone

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
http://www.capstone-engine.org
7.61k stars 1.56k forks source link

CPUID Error #2524

Closed Wker666 closed 3 weeks ago

Wker666 commented 3 weeks ago

Work environment

Questions Answers
OS/arch/bits Windows x64 etc.
Architecture x64
Source of Capstone git clone
Version/git commit v5.0.1,

Instruction bytes giving faulty results

00007FF6FDE91AF1 | 0FA2                     | cpuid                                              |
00007FF6FDE91AF3 | 44:8BC1                  | mov r8d,ecx                                        |
00007FF6FDE91AF6 | 44:8BD2                  | mov r10d,edx                                       |

Steps to get the wrong result

在我设计单步步过（跳过call）时使用capstone反汇编确定指令时出现CPUID指令（0FA2），在下条指令int 3之后发现CPUID出现异常，发现单步之后其实实际上执行的并不是CPUID，并且同样的问题我在x64dbg也发现了。

Additional Logs, screenshots, source code, configuration dump, ...

在上述00007FF6FDE91AF1 地址的指令执行完毕之后会跳过00007FF6FDE91AF3 直接执行到00007FF6FDE91AF6 。 wrong 调试内容： wrong

Wker666 commented 3 weeks ago

抱歉，忘记了虚拟机CPUID的问题(连带问题)，让我误以为时指令集翻译的错误