Skip to content

resolve RIP in some x86 fp semantics - #1637

Open
Angs12 wants to merge 44 commits into
BinaryAnalysisPlatform:masterfrom
Angs12:master
Open

Angs12 wants to merge 44 commits into
BinaryAnalysisPlatform:masterfrom
Angs12:master

Conversation

@Angs12

@Angs12 Angs12 commented May 25, 2026

Copy link
Copy Markdown
Contributor

Bug

During lifting some fp x86 instructions to BIL the RIP is not resolved:

bap mc --show-insn=asm --show-bil -- 0f 54 0d 2a 00 00 00     
andps 0x2a(%rip), %xmm1
{
  YMM1 := high:128[YMM1].127:0[YMM1] & mem[RIP + 0x2A, el]:u128
}

Fix

This pr adds the reg# function already in x86-64.lisp that resolves the PC to the bitwise-rrm macro

The reg# function hardcodes the value 8 for the instruction length, but x86 instructions have variable lenght,
so i added a primus lisp primitive that uses provides the instruction length in bytes that is already in Knowledge Base
and substituted the hardcoded values with that primitive

After fix

bap mc --show-insn=asm --show-bil -- 0f 54 0d 2a 00 00 00
andps 0x2a(%rip), %xmm1
{
  YMM1 := high:128[YMM1].127:0[YMM1] & mem[0x31, el]:u128
}

Angs12 added 30 commits October 23, 2026 23:42
Net effect of the reverted conflict-tolerance experiment: the driver and CFG keep the surviving conflict-tolerant reads.
opam builds with 'dune build -p NAME', which is shorthand for
--release; the -O3 lived only in the dev profile, so every opam-built
bap was compiled with -g and no -O3.
RelocationRef has no getAddend on this LLVM; the ELF-specific ref
does, and its addend is an Expected.  The table row emitted is
unchanged.
The ogre doc parse rejects every entry whose table the scheme does
not declare; the addend rows made the whole doc unparseable.
Angs12 added 11 commits October 23, 2026 23:42
The x86-64 target aliased EAX..EDI and their 16/8-bit parts but declared
no R8D-R15D, R8W-R15W or R8B-R15B.  Semantics that name operands through
the target (the Lisp SSE intrinsics, e.g. CVTSI2SDrr_Int on %r12d) then
read a fresh free variable R12D instead of the low bits of R12.
The scalar min/max replaced all 128 bits with the selected operand; the
destination's upper quadword is preserved.
The double-width result temporary made RAX and RDX extracts of a
concatenation; each register now takes its half directly.
Each x87 instruction lifts to an x87_* intrinsic over its memory
operands and flags; FPU_CONTROL is declared as a target register.
A word wider than the memory's native stores was written with each
chunk shifted one chunk too far and in the opposite byte order.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant