Skip to main content

Module x86_encoding

Module x86_encoding 

Source
Expand description

Byte-level rewrites for setcc / cmovcc on x86 / x86_64.

All functions in this module take the raw byte sequence of the original instruction (as read via r2smt_ir::BytePatcher::read_bytes) and produce a same-length replacement that preserves any prefix bytes, ModR/M, SIB, and displacement bytes. Same-length output is enforced because the patcher writes back over the original footprint; a longer or shorter instruction would either clobber the next instruction or leave invalid bytes behind.

Encoding references:

  • SETcc r/m8[REX]? 0F 9x /0 r/m8
  • MOV r/m8, imm8 — [REX]? C6 /0 r/m8 imm8
  • CMOVcc r, r/m[REX]? 0F 4x /r
  • MOV r, r/m — [REX]? 8B /r

Both pairs share their addressing-byte layout (ModR/M + optional SIB + optional displacement), so the rewrites only swap opcode bytes and either append imm8 (setcc) or a nop (cmovcc).

Functions§

nop_buffer
Return a buffer of len NOPs (0x90). Used both for fully-NOPed setcc / cmovcc instructions (always-false outcome) and for NOP-padding shorter replacements.
nop_byte
Single-byte NOP opcode used for padding patched instructions.
patch_cmovcc_to_mov
Rewrite a CMOVcc instruction as an unconditional MOV r, r/m.
patch_setcc
Rewrite a SETcc instruction so it unconditionally writes value as u8 to its destination operand.