DynamoRIO / DynamoRIO/dynamorio
Serious problem with "Optimized BBCount" example
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
The [DynamoRIO CGO tutorial slides](https://github.com/DynamoRIO/dynamorio/releases/download/release_6_1_0/DynamoRIO-tutorial-mar2016.pdf) are really good. Thanks for publishing them.
There's a major problem with the "Optimized BBCount" example:
```
for (instr = first; instr != NULL; instr = instr_get_next(instr)) {
flags = instr_get_arith_flags(instr);
/* OP_inc doesn't write CF but not worth distinguishing */
if (TESTALL(EFLAGS_WRITE_6, flags) && !TESTANY(EFLAGS_READ_6, flags))
break;
}
```
The problem is that DR treats undefined flags as written, but some instructions whose flag effects are documented as undefined in fact preserve those flags (at least in some implementations). For example `bt` instructions on my Skylake CPU preserve at least ZF and PF (at least sometimes). Thus, on my machine at least, the above optimization is not safe.
Contributor guide
Assessment
This issue has not been assessed yet.