"XSAVE" mnemonic is shown as "XAVE"

gdabah / distorm

Powerful Disassembler Library For x86/AMD64

Other

1.26k stars 238 forks source link

"XSAVE" mnemonic is shown as "XAVE" #37

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago

What steps will reproduce the problem?
Disassemble these bytes in 64-bit mode:
0f ae 20

What is the expected output? What do you see instead?
Expect: XSAVE [RAX]
Get: XAVE [RAX]

What version of the product are you using? On what operating system?

diStorm 3.1 built on MacOS X 10.6.8

Please provide any additional information below.

Looks like a simply typo bug in x86sets.py.

Original issue reported on code.google.com by spa...@rotateright.com on 9 Feb 2012 at 6:35

GoogleCodeExporter commented 9 years ago

Intel Vol 2B 4-532 actually shows that the mnemonic would be XSAVE64 in 64-bit 
mode with the REX.W prefix.

Original comment by spa...@rotateright.com on 9 Feb 2012 at 6:37

GoogleCodeExporter commented 9 years ago

Updated FXRSTOR64, FXSAVE64 and XSAVE64. And added XSAVEOPT/64.

Original comment by distorm@gmail.com on 4 Mar 2012 at 11:49

Changed state: Fixed

GoogleCodeExporter commented 9 years ago

Nice!

$ ./a.out 0f ae 20
   1: (   0) 0fae20                   XSAVE [RAX]
$ ./a.out 48 0f ae 20
   1: (   0) 480fae20                 XSAVE64 [RAX]
$ ./a.out 0f ae 30
   1: (   0) 0fae30                   XSAVEOPT [RAX]
$ ./a.out 48 0f ae 30
   1: (   0) 480fae30                 XSAVEOPT64 [RAX]
$ ./a.out 0f ae 00
   1: (   0) 0fae00                   FXSAVE [RAX]
$ ./a.out 48 0f ae 00
   1: (   0) 480fae00                 FXSAVE64 [RAX]

Original comment by spa...@rotateright.com on 6 Mar 2012 at 5:20