DynamoRIO / DynamoRIO/dynamorio

Serious problem with "Optimized BBCount" example

Open
#1,940 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

The [DynamoRIO CGO tutorial slides](https://github.com/DynamoRIO/dynamorio/releases/download/release_6_1_0/DynamoRIO-tutorial-mar2016.pdf) are really good. Thanks for publishing them.

There's a major problem with the "Optimized BBCount" example:

```
for (instr = first; instr != NULL; instr = instr_get_next(instr)) {
flags = instr_get_arith_flags(instr);
/* OP_inc doesn't write CF but not worth distinguishing */
if (TESTALL(EFLAGS_WRITE_6, flags) && !TESTANY(EFLAGS_READ_6, flags))
break;
}
```

The problem is that DR treats undefined flags as written, but some instructions whose flag effects are documented as undefined in fact preserve those flags (at least in some implementations). For example `bt` instructions on my Skylake CPU preserve at least ZF and PF (at least sometimes). Thus, on my machine at least, the above optimization is not safe.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.