howardjack / distorm

Automatically exported from code.google.com/p/distorm
GNU General Public License v3.0
0 stars 0 forks source link

modifiedFlagsMask #68

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
In what mode did you try to disassemble (16/32/64)?
32

What is the input buffer (binary stream) you used to reproduce the problem?
0x0904fa64:  85c0 TEST EAX, EAX

What is the expected output (or what instruction)?
Manual says modified flags are: SF, ZF,PF and CF, OF (fized to 0) 

Which tool did you use to see the expected output?
custom

What do you see instead?
modifiedFlagsMask = 0x13
List of modified flags:  ['ZF', 'PF']

What version of diStorm are you using? On what platform (Python/EXE/other)?
Python distorm3-3

Please provide any additional information below.

Original issue reported on code.google.com by felipe.a...@gmail.com on 22 May 2013 at 3:51

GoogleCodeExporter commented 9 years ago
Oops I mean. 
TEST EAX,EAX
List of modified flags:  ['ZF', 'SF', 'PF'] 0x13
List of tested flags:  [] 0x0
List of undefined flags:  ['AF'] 0x20

I would have expected to have CF and OF too. Because they are setted to 0.

Original comment by felipe.a...@gmail.com on 22 May 2013 at 4:04

GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
Maybe you could use this to scrap the needed tables?

http://pastebin.com/fgNfqJ3U

Original comment by felipe.a...@gmail.com on 23 May 2013 at 10:34

GoogleCodeExporter commented 9 years ago
Hey

I don't scrap tables, I work with the official tables and have my own tables, 
see disOps project inside diStorm.
I will check it out.
Thanks

Original comment by distorm@gmail.com on 22 Jun 2013 at 8:56

GoogleCodeExporter commented 9 years ago
As disOps says "Note that some instruction reset specific flags, but we don't 
record that here, we only care about actually modified ones.".
I didn't want to add extra noise to the modified flags field, therefore flags 
that get reset in some instructions are ignored. This is because of a problem 
with AMD vs. Intel too, some differences in flags behavior AFAIK.

Original comment by distorm@gmail.com on 22 Jun 2013 at 8:11