zyantific/zydis v3.0.0

on GitHub

Detailed changelog (since v2.0.3)

Decoder

• Improved legacy prefix decoding
• Fixed gather register check for VGATHERPF0{D|Q}{PS|PD} instruction
• Fixed some incorrect assert conditions
• Fixed check for invalid BOUND registers
• Fixed incorrect value of ZydisDecodedInstruction.raw.prefixes[n].type in some edge cases

Formatter

• Implemented AT&T formatter-style
• Implemented MASM formatter-style
• Implemented tokenization feature to the instruction
  • ZydisFormatterTokenizeInstruction/ZydisFormatterTokenizeInstructionEx and ZydisFormatterTokenizeOperand/ZydisFormatterTokenizeOperandEx generates a token-list instead of a simple string
  • Each token has a type (like MNEMONIC, REGISTER, DELIMITER) and contains a string
  • Tokenization allows users to receive the formatted instructions as a stream of tokens with annotations of their purpose, allowing for easier implementation of features such as syntax highlighting
• Numeric base (decimal, hexadecimal), signedness and padding can now be independently configured for all numeric types (addresses, displacements and immediates)
• Added "detailed prefixes" mode
  • Prints all instruction prefixes instead of only the effective ones
• Replaced the ZYDIS_FORMATTER_PROP_UPPERCASE property with more granular options
  • Allows configuration of the letter-case individually for prefixes, mnemonics, registers, typecasts and decorators
• Implemented more formatter options
  • ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_BRANCHES
    • Prints relative addresses instead of absolute ones for branch instructions
  • ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_RIPREL
    • Prints relative addresses instead of absolute ones for EIP/RIP-relative instructions
  • ZYDIS_FORMATTER_PROP_PRINT_BRANCH_SIZE
    • Prints the size of branch instructions (short/near)

Database

• Added BF16 instructions
• Added vp2intersect{d|q} instructions
• Added enqcmd and enqcmds instructions
• Added AMD rdpru instruction
• Added PADLOCK instructions
• Added CLDEMOTE, MOVDIR and WAITPKG extensions
• Added implicit PKRU register to the RDPKRU/WRPKRU instructions
• Fixed exception-class of v4fmaddss, v4fnmaddss and vcvtps2ph
• Fixed KNL gather/scatter memory operand width
• Fixed mask-mode for some EVEX instructions
• Fixed element size of VP4DPWSSDS memory operand
• Fixed MONITOR, MONITORX, MWAIT and MWAITX operands
• Fixed CLRSSBSY memory operand is read-write
• Fixed VMREAD destination operand is write-only
• Fixed decoding of nop (0F 1C) with 66 prefix
• Fixed decoding of rdrand and rdseed with 66 prefix
• Fixed decoding of xstore with 66 prefix
• Adjusted element-type for auto generated FLAGS/EFLAGS/RFLAGS and X87STATUS operands
• Updated movsxd source register width
• Introduced a new element-type for condition-codes
  • This allows generic detection of condition-code operands without hardcoding any instruction mnemonics (e.g. used by CMPPS, VCMPPD, ...)
• Added support for non-default address-size configurations
  • Some instructions (e.g. ENCLS or BNDCL) are using non-default address-size configurations like ignoring the address-size override prefix or forcing the address size to certain values
• Use MODRM_RM instead of MODRM_REG for the destination register of EXTRQ
• Removed W0 filter from LLWPCB/SLWPCB (is allowed to have 64-bit operand-size)
• Added new attributes for instructions that access CPU/FPU/XMM state
  • ZYDIS_ATTRIB_CPU_STATE_{CR|CW} for general CPU-state access
  • ZYDIS_ATTRIB_FPU_STATE_{CR|CW} for FPU-state (x87 and MMX) access
  • ZYDIS_ATTRIB_XMM_STATE_{CR|CW} for XMM-state access
• Fixed CPU-flag actions for instructions that TEST and MODIFIY certain flags at the same time
  • Introduced a new CPU-flag action called TESTED_MODIFIED
• Added ZYDIS_ATTRIB_CPU_STATE_{CR|CW} attribute to iret{d|q}
• Added implicit writes for the CS and SS registers to syscall and sysret

Misc

• Implemented color support (VT100) and syntax highlighting for the ZydisInfo tool
• Added ZydisGetInstructionSegments helper function
  • Returns a list that maps the different instruction segments (like OPCODE, MODRM, ...) to an offset-size pair
  • The ZydisInfo tool now prints the hexadecimal instruction bytes using different colors considering the instruction segment
• Added ZydisCalcAbsoluteAddressEx which takes an additional register-context argument to allow calculation of addresses depending on runtime register values
• Introduced ZYDIS_MINIMAL_MODE CMake option
  • Forces ZYDIS_DECODER_MODE_MINIMAL
  • Reduces file size by excluding unused code and data-tables
• Improved MSVC project