DynamoRIO / DynamoRIO/dynamorio
64-bit Windows only preserves xmm0-5 but does not document this clearly
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
**Describe the bug**
For latestest version 10.0.0 and older version 9.0.0.1, I find the same bugs.
Inside a clean call, when fetching values of SIMD or avx512 registers greater than xmm8 (e.g. xmm10), the value is obviously wrong, but for xmm1-xmm8, the value is right.
Here is the evidence.
When I insert clean call before and after paddd instruction, I print values of each register before and after the execution of instruction.
I do set the save_fp_state flag when insert that clean call.
Here is the wrong case for a trace.
paddd xmm0,xmm11
before execution:
xmm0:00005c0000805c0000005d0000805d00
xmm11:010000000000000048c139a4b9010000
after execution:
xmm0:ff7fdc00ffffdc00ff7fdd00ffffdd00
the value of xmm11 is obviously wrong.
Here is the right case for same trace.
paddd xmm2,xmm3
before execution:
xmm2:bc000000bc000000bc000000bc000000
xmm3:00000000010000000200000003000000
after execution:
xmm2:bc000000bd000000be000000bf000000
this execution is right!
Note that the two cases happen in same trace!
After detailed check, the wrong reason is the dynamoRIO dr_mc_context cannot get the values of registers with id greater than xmm8!
The OS is latest Win10 at 2023-9-27, kernel version is 19045.3448, CPU is i5-8700.
Please fix this bug. This seems urgent as it will cause wrong results for taint analysis or concolic execution tools based on DynamoRIO.
We provide the tested file and its input [(click here to download)](https://1drv.ms/f/s!ArXpCPHGoZN5oh60ubUC8l4i9FHK?e=XXy0C2) you can just write a simple client to monitor any instruction which uses xmm10 or xmm11 registers such as paddd or pslld.
In that link, test_jpeg.exe depends on jpeg62.dll in the same directory, jpeg62.dll is also put in the link. you should put jpeg62.dll in the same directory as test_jpeg.exe and run command like 'drrun.exe -c your_client.dll -- test_jpeg.exe input.jpg'.
Contributor guide
Assessment
This issue has not been assessed yet.