capstone-engine
bnd jne instruction
I use IDA and capstone to disassemble a PE file. But there's a difference, which is bnd jne in capstone but repne jnz short in IDA. Would you please tell the reason?
Is this from master, or next branch?
Can you provide the input of this case?
@aquynh the result disassembled by capstone 0x1400010a0: cmp rcx, qword ptr [rip + 0x1f61] 0x1400010a7: bnd jne 0x1400010bc 0x1400010aa: rol rcx, 0x10 0x1400010ae: test cx, 0xffff 0x1400010b3: bnd jne 0x1400010b8 0x1400010b6: bnd ret
the result disassembled by IDA .text:00000001400010A0 cmp rcx, cs:__security_cookie . text:00000001400010A7 repne jnz short loc_1400010BC .text:00000001400010AA rol rcx, 10h .text:00000001400010AE test cx, 0FFFFh .text:00000001400010B3 repne jnz short loc_1400010B8 .text:00000001400010B6 repne retn
ok, but you havent provided the input code yet: what you gave is only assembly & instruction address.
you can enable Opcode output from menu "Options" -> "General ..." -> "Number of opcode bytes" . You can put 8 in this box, press OK, then paste the output here again.
@aquynh .text:00000001400010A0--- 48 3B 0D 61 1F 00 00------- cmp rcx, cs:__security_cookie .text:00000001400010A7--- F2 75 12--------------------- repne jnz short loc_1400010BC .text:00000001400010AA--- 48 C1 C1 10----------------- rol rcx, 10h .text:00000001400010AE--- 66 F7 C1 FF FF-------------- test cx, 0FFFFh .text:00000001400010B3--- F2 75 02-------------------- repne jnz short loc_1400010B8 .text:00000001400010B6--- F2 C3----------------------- repne retn
all jump instructions should not associate with REP prefix, so IDA is confused here.
ping @radare.
i should check the intel manual to confirm that behaviour, but it will be good to compare with other disassemblers too.
On 6 Jul 2017, at 07:19, Nguyen Anh Quynh [email protected] wrote:
all jump instructions should not associate with REP prefix, so IDA is confused here.
ping @radare https://github.com/radare.
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/aquynh/capstone/issues/955#issuecomment-313297631, or mute the thread https://github.com/notifications/unsubscribe-auth/AA3-lhlXXympcb8uH4H_GLOw22nEEVuvks5sLG5mgaJpZM4OPEB3.
according to Intel manual, REP prefix is only relevant for string instructions + IN/OUT. it is wrong to have REP with jump instructions.
Some old AMD CPUs exhibit a branch prediction bug when you have a jump going straight to another jump (or return). Jumping to the rep prefix instead is a workaround for it. Both Intel and AMD CPUs tolerate it without any adverse effects.
yes, but i mean it is better to remove REP in the disassembly output in such a case.