redballoonsecurity / ofrak

OFRAK: unpack, modify, and repack binaries.
https://ofrak.com
Other
1.85k stars 127 forks source link

Fix AARCH64 Keystone Vector Instructions bug #316

Open rbs-alexr opened 1 year ago

rbs-alexr commented 1 year ago

One sentence summary of this PR (This should go in the CHANGELOG!) When capstone disassembles the bytes for the following instruction "movi v0.2d #0" it represents it as "movi v0.0x2d #0" which causes keystone to throw an "Unknown Operand" error.

Link to Related Issue(s) N/A

Please describe the changes in your request. I added some processing to the assembler_service_keystone to work around this capstone bug

Anyone you think should look at this, specifically? @whyitfor

rbs-alexr commented 1 year ago

To provide some context to the most recent commits. The erroneous behavior we were observing was not due to keystone, it was due to our own _asm_fixups function in disassembler_service_capstone. We had regex to convert constants to their hex values, which breaks for vector instructions. The new code skips this conversion if the mnemonic is from a list of known AARCH64 vector instructions