Add support for xmmword ref during dissasm.

CERT-Polska · Jun 11, 2024 · db5eb6b · db5eb6b
1 parent 929c3e4
commit db5eb6b
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/malduck/disasm.py b/malduck/disasm.py
@@ -29,6 +29,7 @@ class Operand:
         2: "word",
         4: "dword",
         8: "qword",
+        16: "xmmword"
     }
 
     def __init__(self, op: X86Op, x64: bool) -> None:

diff --git a/tests/test_disasm.py b/tests/test_disasm.py
@@ -21,6 +21,8 @@ class TestDisasm(object):
         b"\xe8\x00\x00\x00\x00",
         # movxz eax, byte [0x400000]
         b"\x0f\xb6\x05\x00\x00\x04\x00",
+        # movups xmmword ptr [esi+0Ch], xmm0
+        b"\x0f\x11\x46\x0c"
     ))
 
     def setup_method(self):
@@ -60,6 +62,10 @@ def test_insns(self):
         assert insn7.op2.reg is None
         assert insn7.op2 == (None, None, None, 0x400000)
 
+        insn8 = self.insns[7]
+        assert insn8.op2.reg == "xmm0"
+        assert insn8.op1.mem == ("xmmword", "esi", None, None, 0x0C)
+
     def test_equal(self):
         assert next(disasm(b"hAAAA", 0)).mnem == "push"
         assert next(disasm(b"hAAAA", 0)).op1.value == 0x41414141