### Lua Setup for Code Movement Example Source: https://github.com/icedland/iced/blob/master/src/rust/iced-x86-lua/README.md Imports necessary modules from the iced_x86 library for instruction decoding, encoding, and formatting. This setup is required for the code movement example. ```lua local BlockEncoder = require("iced_x86.BlockEncoder") local Code = require("iced_x86.Code") local Decoder = require("iced_x86.Decoder") local FlowControl = require("iced_x86.FlowControl") local Formatter = require("iced_x86.Formatter") local FormatterSyntax = require("iced_x86.FormatterSyntax") local Instruction = require("iced_x86.Instruction") local OpKind = require("iced_x86.OpKind") local unpack = unpack or table.unpack ``` -------------------------------- ### Intel Syntax vpbroadcastq Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Demonstrates the 'vpbroadcastq' instruction with memory operands and register destinations. Includes examples with the '{k5}' mask and the 'eh' modifier. ```assembly vpbroadcastq 8(rax), zmm2{k5} vpbroadcastq 8(rax){eh}, zmm26 ``` -------------------------------- ### VP MAXUQ Instruction Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Masm/Test64_MemMinimum.txt Illustrates VP MAXUQ for unsigned quadword maximum. Includes examples with registers, memory, and mask registers. ```asm vpmaxuq xmm2{k3}{z}, xmm6, xmm3 vpmaxuq xmm2{k3}, xmm6, [rax+10h] vpmaxuq xmm2{k5}{z}, xmm6, qword bcst [rax+8] vpmaxuq ymm2{k3}{z}, ymm6, ymm3 vpmaxuq ymm2{k3}, ymm6, [rax+20h] vpmaxuq ymm2{k5}{z}, ymm6, qword bcst [rax+8] vpmaxuq zmm2{k3}{z}, zmm6, zmm3 vpmaxuq zmm2{k3}, zmm6, [rax+40h] vpmaxuq zmm2{k5}{z}, zmm6, qword bcst [rax+8] ``` -------------------------------- ### .NET Installation for Iced Source: https://context7.com/icedland/iced/llms.txt Installs the Iced NuGet package for .NET projects. Ensure you are using a compatible version. ```sh # .NET dotnet add package iced --version 1.21.0 ``` -------------------------------- ### VP MAXUW Instruction Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Masm/Test64_MemMinimum.txt Demonstrates VP MAXUW for unsigned word maximum. Includes examples with registers, memory, and mask registers. ```asm pmaxuw xmm1, xmm5 pmaxuw xmm1, [rax] vpmaxuw xmm2, xmm6, xmm3 vpmaxuw xmm2, xmm6, [rax] vpmaxuw ymm2, ymm6, ymm3 vpmaxuw ymm2, ymm6, [rax] vpmaxuw xmm2{k3}, xmm6, xmm3 vpmaxuw xmm2{k3}, xmm6, [rax+10h] vpmaxuw ymm2{k3}, ymm6, ymm3 vpmaxuw ymm2{k3}, ymm6, [rax+20h] vpmaxuw zmm2{k3}, zmm6, zmm3 vpmaxuw zmm2{k3}, zmm6, [rax+40h] ``` -------------------------------- ### Intel Formatter: VPCMPGTD Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Demonstrates VPCMPGTD instructions with various addressing modes, masks, and data types. Use these examples to test the formatter's handling of signed integer comparisons. ```assembly vpcmpgtd 0x40(rax){eh}, zmm6, k2 vpcmpgtd 4(rax){eh}{1to16}, zmm6, k2 vpcmpgtd 0x10(rax){eh}{4to16}, zmm6, k2 vpcmpgtd 0x10(rax){eh}{uint8}, zmm6, k2 vpcmpgtd 0x10(rax){eh}{sint8}, zmm14, k2 vpcmpgtd 0x20(rax){eh}{uint16}, zmm22, k2 vpcmpgtd 0x20(rax){eh}{sint16}, zmm30, k2 vpcmpgtd zmm3, zmm6, k2 vpcmpgtd zmm3{cdab}, zmm6, k2{k3} vpcmpgtd zmm3{badc}, zmm6, k2 vpcmpgtd zmm3{dacb}, zmm6, k2 vpcmpgtd zmm11{aaaa}, zmm6, k2 vpcmpgtd zmm19{bbbb}, zmm6, k2 vpcmpgtd zmm27{cccc}, zmm6, k2 vpcmpgtd zmm3{dddd}, zmm6, k2 vpcmpgtd zmm3, zmm6, k2 ``` -------------------------------- ### XBEGIN Transactional Memory Instructions Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Masm/Test64_MemAlways.txt Examples of the XBEGIN instruction for starting transactional memory regions with different addresses. ```assembly xbegin 7FFFFFFFFFFFA54Fh xbegin 800000003412A550h xbegin 800000003412A551h ``` -------------------------------- ### Get Instruction Info with iced-x86-js Source: https://github.com/icedland/iced/blob/master/src/rust/iced-x86-js/README.md This example demonstrates how to decode x86 instructions and retrieve detailed information about them, including opcode, mnemonic, encoding, and register/memory usage. Ensure the necessary features are enabled for the decoder and instruction API. ```javascript // iced-x86 features needed: --features "decoder masm instr_api encoder op_code_info instr_info" const { Code, ConditionCode, CpuidFeature, Decoder, DecoderOptions, EncodingKind, FlowControl, Instruction, InstructionInfoFactory, MemorySize, MemorySizeExt, Mnemonic, OpAccess, OpCodeOperandKind, OpKind, Register, RflagsBits, } = require("iced-x86"); /* This code produces the following output: 00007FFAC46ACDA4 mov [rsp+10h],rbx OpCode: o64 89 /r Instruction: MOV r/m64, r64 Encoding: Legacy Mnemonic: Mov Code: Mov_rm64_r64 CpuidFeature: X64 FlowControl: Next Displacement offset = 4, size = 1 Memory size: 8 Op0Access: Write Op1Access: Read Op0: r64_or_mem Op1: r64_reg Used reg: RSP:Read Used reg: RBX:Read Used mem: [SS:RSP+0x10;UInt64;Write] 00007FFAC46ACDA9 mov [rsp+18h],rsi OpCode: o64 89 /r Instruction: MOV r/m64, r64 Encoding: Legacy Mnemonic: Mov Code: Mov_rm64_r64 CpuidFeature: X64 FlowControl: Next Displacement offset = 4, size = 1 Memory size: 8 Op0Access: Write Op1Access: Read Op0: r64_or_mem Op1: r64_reg Used reg: RSP:Read Used reg: RSI:Read Used mem: [SS:RSP+0x18;UInt64;Write] 00007FFAC46ACDAE push rbp OpCode: o64 50+ro Instruction: PUSH r64 Encoding: Legacy Mnemonic: Push Code: Push_r64 CpuidFeature: X64 FlowControl: Next SP Increment: -8 Op0Access: Read Op0: r64_opcode Used reg: RBP:Read Used reg: RSP:ReadWrite Used mem: [SS:RSP+0xFFFFFFFFFFFFFFF8;UInt64;Write] 00007FFAC46ACDAF push rdi OpCode: o64 50+ro Instruction: PUSH r64 Encoding: Legacy Mnemonic: Push Code: Push_r64 CpuidFeature: X64 FlowControl: Next SP Increment: -8 Op0Access: Read Op0: r64_opcode Used reg: RDI:Read Used reg: RSP:ReadWrite Used mem: [SS:RSP+0xFFFFFFFFFFFFFFF8;UInt64;Write] 00007FFAC46ACDB0 push r14 OpCode: o64 50+ro Instruction: PUSH r64 Encoding: Legacy Mnemonic: Push Code: Push_r64 CpuidFeature: X64 FlowControl: Next SP Increment: -8 Op0Access: Read Op0: r64_opcode Used reg: R14:Read Used reg: RSP:ReadWrite Used mem: [SS:RSP+0xFFFFFFFFFFFFFFF8;UInt64;Write] 00007FFAC46ACDB2 lea rbp,[rsp-100h] OpCode: o64 8D /r Instruction: LEA r64, m Encoding: Legacy Mnemonic: Lea Code: Lea_r64_m CpuidFeature: X64 FlowControl: Next Displacement offset = 4, size = 4 Op0Access: Write Op1Access: NoMemAccess Op0: r64_reg Op1: mem Used reg: RBP:Write Used reg: RSP:Read 00007FFAC46ACDBA sub rsp,200h OpCode: o64 81 /5 id Instruction: SUB r/m64, imm32 Encoding: Legacy Mnemonic: Sub Code: Sub_rm64_imm32 CpuidFeature: X64 FlowControl: Next Immediate offset = 3, size = 4 RFLAGS Written: OF, SF, ZF, AF, CF, PF RFLAGS Modified: OF, SF, ZF, AF, CF, PF Op0Access: ReadWrite Op1Access: Read Op0: r64_or_mem Op1: imm32sex64 Used reg: RSP:ReadWrite 00007FFAC46ACDC1 mov rax,[7FFAC47524E0h] OpCode: o64 8B /r Instruction: MOV r64, r/m64 Encoding: Legacy Mnemonic: Mov Code: Mov_r64_rm64 CpuidFeature: X64 FlowControl: Next Displacement offset = 3, size = 4 Memory size: 8 Op0Access: Write Op1Access: Read Op0: r64_reg Op1: r64_or_mem Used reg: RAX:Write Used mem: [DS:0x7FFAC47524E0;UInt64;Read] 00007FFAC46ACDC8 xor rax,rsp OpCode: o64 33 /r Instruction: XOR r64, r/m64 Encoding: Legacy Mnemonic: Xor Code: Xor_r64_rm64 CpuidFeature: X64 FlowControl: Next RFLAGS Written: SF, ZF, PF RFLAGS Cleared: OF, CF RFLAGS Undefined: AF RFLAGS Modified: OF, SF, ZF, AF, CF, PF Op0Access: ReadWrite Op1Access: Read Op0: r64_reg Op1: r64_or_mem Used reg: RAX:ReadWrite Used reg: RSP:Read 00007FFAC46ACDCB mov [rbp+0F0h],rax OpCode: o64 89 /r Instruction: MOV r/m64, r64 Encoding: Legacy Mnemonic: Mov Code: Mov_rm64_r64 CpuidFeature: X64 FlowControl: Next Displacement offset = 3, size = 4 Memory size: 8 Op0Access: Write Op1Access: Read Op0: r64_or_mem Op1: r64_reg Used reg: RBP:Read Used reg: RAX:Read Used mem: [SS:RBP+0xF0;UInt64;Write] 00007FFAC46ACDD2 mov r8,[7FFAC474F208h] OpCode: o64 8B /r Instruction: MOV r64, r/m64 Encoding: Legacy Mnemonic: Mov Code: Mov_r64_rm64 CpuidFeature: X64 FlowControl: Next Displacement offset = 3, size = 4 Memory size: 8 Op0Access: Write Op1Access: Read Op0: r64_reg Op1: r64_or_mem Used reg: R8:Write Used mem: [DS:0x7FFAC474F208;UInt64;Read] 00007FFAC46ACDD9 lea rax,[7FFAC46F4A58h] ``` -------------------------------- ### Intel Formatter: VPCMPLTD Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Provides examples of VPCMPLTD instructions, covering various operand types, addressing modes, and masks. These are useful for testing signed integer less-than comparisons. ```assembly vpcmpltd 0x40(rax), zmm6, k2 vpcmpltd 4(rax){1to16}, zmm6, k2 vpcmpltd 0x10(rax){4to16}, zmm6, k2 vpcmpltd 0x10(rax){uint8}, zmm6, k2{k3} vpcmpltd 0x10(rax){sint8}, zmm6, k2 vpcmpltd 0x20(rax){uint16}, zmm6, k2 vpcmpltd 0x20(rax){sint16}, zmm6, k2 vpcmpltd 0x40(rax){eh}, zmm6, k2 vpcmpltd 4(rax){eh}{1to16}, zmm6, k2 vpcmpltd 0x10(rax){eh}{4to16}, zmm6, k2 vpcmpltd 0x10(rax){eh}{uint8}, zmm6, k2 vpcmpltd 0x10(rax){eh}{sint8}, zmm14, k2 vpcmpltd 0x20(rax){eh}{uint16}, zmm22, k2 vpcmpltd 0x20(rax){eh}{sint16}, zmm30, k2 vpcmpltd zmm3, zmm6, k2 vpcmpltd zmm3{cdab}, zmm6, k2{k3} vpcmpltd zmm3{badc}, zmm6, k2 vpcmpltd zmm3{dacb}, zmm6, k2 vpcmpltd zmm11{aaaa}, zmm6, k2 vpcmpltd zmm19{bbbb}, zmm6, k2 vpcmpltd zmm27{cccc}, zmm6, k2 vpcmpltd zmm3{dddd}, zmm6, k2 vpcmpltd zmm3, zmm6, k2 ``` -------------------------------- ### Iterate and Get Instruction Information Source: https://github.com/icedland/iced/blob/master/src/rust/iced-x86-lua/README.md Iterates through instructions using a Decoder, retrieving and printing various pieces of information such as IP, OpCode, Mnemonic, FlowControl, and FPU stack info. This example demonstrates how to access detailed properties of each instruction. ```lua local decoder = Decoder.new(example_code_bitness, example_code, nil, example_code_rip) for instr in decoder:iter_out() do -- Gets offsets in the instruction of the displacement and immediates and their sizes. -- This can be useful if there are relocations in the binary. The encoder has a similar -- method. This method must be called after decode() and you must pass in the last -- instruction decode() returned. local offsets = decoder:get_constant_offsets(instr) print(string.format("%016X %s", instr:ip(), tostring(instr))) local op_code = instr:op_code() local fpu_info = instr:fpu_stack_increment_info() print(string.format(" OpCode: %s", op_code:op_code_string())) print(string.format(" Instruction: %s", op_code:instruction_string())) print(string.format(" Encoding: %s", encoding_kind_to_string(instr:encoding()))) print(string.format(" Mnemonic: %s", mnemonic_to_string(instr:mnemonic()))) print(string.format(" Code: %s", code_to_string(instr:code()))) print(string.format(" CpuidFeature: %s", cpuid_features_to_string(instr:cpuid_features()))) print(string.format(" FlowControl: %s", flow_control_to_string(instr:flow_control()))) if fpu_info:writes_top() then if fpu_info:increment() == 0 then print(" FPU TOP: the instruction overwrites TOP") else print(string.format(" FPU TOP inc: %s", fpu_info:increment())) end local cond_write = fpu_info:conditional() and "true" or "false" print(string.format(" FPU TOP cond write: %s", cond_write)) end if offsets:has_displacement() then print( string.format( " Displacement offset = %d, size = %d", offsets:displacement_offset(), offsets:displacement_size() ) ) end if offsets:has_immediate() then ``` -------------------------------- ### TILE Instructions for Data Loading and Storing Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Masm/Test64_MemDefault.txt Demonstrates tile data loading and storing instructions: TILEZERO, TILELOADD, TILELOADDt1, and TILESTORED. ```assembly tilezero tmm2 ``` ```assembly tileloaddt1 tmm2,[rcx+rdx*4] ``` ```assembly tileloaddt1 tmm2,[rsp] ``` ```assembly tilestored [rcx+rdx*4],tmm2 ``` ```assembly tilestored [rsp],tmm2 ``` ```assembly tileloadd tmm2,[rcx+rdx*4] ``` ```assembly tileloadd tmm2,[rsp] ``` -------------------------------- ### Assemble x86/x64 Instructions Source: https://github.com/icedland/iced/blob/master/src/rust/iced-x86-py/README.md Shows how to assemble mnemonic instructions into machine code bytes. The `Encoder` can be configured with the bitness (16, 32, or 64) and the starting IP. Instructions are added to the encoder, and then `encode` is called to get the resulting bytes. Ensure the `Instruction` objects are valid for the target bitness. ```python from iced_x86 import * # Encode 16-bit code encoder = Encoder(16, b"\x00" * 16) encoder.ip = 0x1000 instruction = Instruction() instruction.mnemonic = Mnemonic.MOV instruction.op0_kind = OpKind.REGISTER instruction.op0_register = Register.AX instruction.op1_kind = OpKind.IMMEDIATE instruction.op1_immediate = 0x1234 encoder.add_instruction(instruction) instruction = Instruction() instruction.mnemonic = Mnemonic.ADD instruction.op0_kind = OpKind.REGISTER instruction.op0_register = Register.AX instruction.op1_kind = OpKind.REGISTER instruction.op1_register = Register.BX encoder.add_instruction(instruction) encoded_bytes = encoder.encode() print(f"16-bit: {encoded_bytes.hex()}") # Encode 32-bit code encoder = Encoder(32, b"\x00" * 16) encoder.ip = 0x1000 instruction = Instruction() instruction.mnemonic = Mnemonic.MOV instruction.op0_kind = OpKind.REGISTER instruction.op0_register = Register.EAX instruction.op1_kind = OpKind.IMMEDIATE instruction.op1_immediate = 0x12345678 encoder.add_instruction(instruction) encoded_bytes = encoder.encode() print(f"32-bit: {encoded_bytes.hex()}") # Encode 64-bit code encoder = Encoder(64, b"\x00" * 16) encoder.ip = 0x1000 instruction = Instruction() instruction.mnemonic = Mnemonic.MOV instruction.op0_kind = OpKind.REGISTER instruction.op0_register = Register.RAX instruction.op1_kind = OpKind.IMMEDIATE instruction.op1_immediate = 0x1122334455667788 encoder.add_instruction(instruction) encoded_bytes = encoder.encode() print(f"64-bit: {encoded_bytes.hex()}") ``` -------------------------------- ### vpandd Examples (Intel Syntax, Gas) Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Illustrates the vpandd instruction with various memory operands, element sizes, and rounding modes. Pay attention to the displacement and element size specifiers. ```assembly vpandd 0x40(rax), zmm6, zmm2 ``` ```assembly vpandd 4(rax){1to16}, zmm6, zmm10 ``` ```assembly vpandd 0x10(rax){4to16}, zmm6, zmm18 ``` ```assembly vpandd 0x10(rax){uint8}, zmm6, zmm2{k3} ``` ```assembly vpandd 0x10(rax){sint8}, zmm6, zmm2 ``` ```assembly vpandd 0x20(rax){uint16}, zmm6, zmm2 ``` ```assembly vpandd 0x20(rax){sint16}, zmm6, zmm2 ``` ```assembly vpandd 0x40(rax){eh}, zmm6, zmm2 ``` ```assembly vpandd 4(rax){eh}{1to16}, zmm6, zmm2 ``` ```assembly vpandd 0x10(rax){eh}{4to16}, zmm6, zmm2 ``` ```assembly vpandd 0x10(rax){eh}{uint8}, zmm6, zmm2 ``` ```assembly vpandd 0x10(rax){eh}{sint8}, zmm14, zmm2 ``` ```assembly vpandd 0x20(rax){eh}{uint16}, zmm22, zmm2 ``` ```assembly vpandd 0x20(rax){eh}{sint16}, zmm30, zmm2 ``` ```assembly vpandd zmm3, zmm6, zmm2 ``` ```assembly vpandd zmm3{cdab}, zmm6, zmm10{k3} ``` ```assembly vpandd zmm3{badc}, zmm6, zmm18 ``` ```assembly vpandd zmm3{dacb}, zmm6, zmm26 ``` ```assembly vpandd zmm11{aaaa}, zmm6, zmm2 ``` ```assembly vpandd zmm19{bbbb}, zmm6, zmm2 ``` ```assembly vpandd zmm27{cccc}, zmm6, zmm2 ``` ```assembly vpandd zmm3{dddd}, zmm6, zmm2 ``` -------------------------------- ### Install iced-x86 Lua Bindings Source: https://github.com/icedland/iced/blob/master/src/rust/iced-x86-lua/README.md Install the iced-x86 Lua bindings using luarocks. Ensure Rust and Lua 5.1+ are installed. ```bash cd this-dir luarocks make *.rockspec ``` -------------------------------- ### VFMSUB231PS/PD Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Provides examples for VFMSUB231PS and VFMSUB231PD instructions. These examples demonstrate various operand sizes, addressing modes, and mask/rounding options. ```assembly vfmsub231ps xmm3, xmm6, xmm2 ``` ```assembly vfmsub231ps (rax), xmm6, xmm2 ``` ```assembly vfmsub231ps ymm3, ymm6, ymm2 ``` ```assembly vfmsub231ps (rax), ymm6, ymm2 ``` ```assembly vfmsub231pd xmm3, xmm6, xmm2 ``` ```assembly vfmsub231pd (rax), xmm6, xmm2 ``` ```assembly vfmsub231pd ymm3, ymm6, ymm2 ``` ```assembly vfmsub231pd (rax), ymm6, ymm2 ``` ```assembly vfmsub231ps xmm3, xmm6, xmm2{k3}{z} ``` ```assembly vfmsub231ps 0x10(rax), xmm6, xmm2{k3} ``` ```assembly vfmsub231ps 4(rax){1to4}, xmm6, xmm2{k5}{z} ``` ```assembly vfmsub231ps ymm3, ymm6, ymm2{k3}{z} ``` ```assembly vfmsub231ps 0x20(rax), ymm6, ymm2{k3} ``` ```assembly vfmsub231ps 4(rax){1to8}, ymm6, ymm2{k5}{z} ``` ```assembly vfmsub231ps {ru-sae}, zmm3, zmm6, zmm2{k3}{z} ``` ```assembly vfmsub231ps 0x40(rax), zmm6, zmm2{k3} ``` ```assembly vfmsub231ps 4(rax){1to16}, zmm6, zmm2{k5}{z} ``` ```assembly vfmsub231pd xmm3, xmm6, xmm2{k3}{z} ``` ```assembly vfmsub231pd 0x10(rax), xmm6, xmm2{k3} ``` ```assembly vfmsub231pd 8(rax){1to2}, xmm6, xmm2{k5}{z} ``` ```assembly vfmsub231pd ymm3, ymm6, ymm2{k3}{z} ``` ```assembly vfmsub231pd 0x20(rax), ymm6, ymm2{k3} ``` ```assembly vfmsub231pd 8(rax){1to4}, ymm6, ymm2{k5}{z} ``` ```assembly vfmsub231pd {ru-sae}, zmm3, zmm6, zmm2{k3}{z} ``` ```assembly vfmsub231pd 0x40(rax), zmm6, zmm2{k3} ``` ```assembly vfmsub231pd 8(rax){1to8}, zmm6, zmm2{k5}{z} ``` -------------------------------- ### VPSUBRD Examples Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Illustrates the VPSUBRD instruction with memory operands, element sizes, and 'eh' control. ```asm vpsubrd 0x40(rax), zmm6, zmm2 vpsubrd 4(rax){1to16}, zmm6, zmm10 vpsubrd 0x10(rax){4to16}, zmm6, zmm18 vpsubrd 0x10(rax){uint8}, zmm6, zmm2{k3} vpsubrd 0x10(rax){sint8}, zmm6, zmm2 vpsubrd 0x20(rax){uint16}, zmm6, zmm2 vpsubrd 0x20(rax){sint16}, zmm6, zmm2 vpsubrd 0x40(rax){eh}, zmm6, zmm2 vpsubrd 4(rax){eh}{1to16}, zmm6, zmm2 vpsubrd 0x10(rax){eh}{4to16}, zmm6, zmm2 vpsubrd 0x10(rax){eh}{uint8}, zmm6, zmm2 vpsubrd 0x10(rax){eh}{sint8}, zmm14, zmm2 vpsubrd 0x20(rax){eh}{uint16}, zmm22, zmm2 vpsubrd 0x20(rax){eh}{sint16}, zmm30, zmm2 vpsubrd zmm3, zmm6, zmm2 vpsubrd zmm3{cdab}, zmm6, zmm10{k3} vpsubrd zmm3{badc}, zmm6, zmm18 vpsubrd zmm3{dacb}, zmm6, zmm26 vpsubrd zmm11{aaaa}, zmm6, zmm2 vpsubrd zmm19{bbbb}, zmm6, zmm2 vpsubrd zmm27{cccc}, zmm6, zmm2 vpsubrd zmm3{dddd}, zmm6, zmm2 vpsubrd zmm3, zmm6, zmm2 ``` -------------------------------- ### VFMADD213PS with Register Operands (Example) Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Masm/Test64_MemDefault.txt A specific example of VFMADD213PS with register operands. ```Assembly vfmsub213ps zmm2,zmm6,zmm3 ``` -------------------------------- ### XSTORE, XCRYPTECB, XCBC, XCTR, XCFB, XOFB instructions Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Nasm/Test64_MemDefault.txt Demonstrates XSTORE and various XCRYPT instructions, with and without the REP prefix. ```Assembly rep xstore a32 xstore xstore a32 xstore rep xcryptecb a32 rep xcryptecb rep xcryptcbc a32 rep xcryptcbc rep xcryptctr a32 rep xcryptctr rep xcryptcfb a32 rep xcryptcfb rep xcryptofb a32 rep xcryptofb ``` -------------------------------- ### VPACKSTORELD Instructions Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Fast/Test64_Inverted.txt Demonstrates VPACKSTORELD instructions for packing and storing data. Supports various data types (byte, word, dword) and memory addressing modes. Includes variations with masking and rounding. ```assembly vpackstoreld dword ptr ds:[rax+0x4], zmm2 vpackstoreld byte ptr ds:[rax+0x1]{k3}, zmm2{uint8} vpackstoreld byte ptr ds:[rax+0x1], zmm2{sint8} vpackstoreld word ptr ds:[rax+0x2], zmm2{uint16} vpackstoreld word ptr ds:[rax+0x2], zmm2{sint16} vpackstoreld dword ptr ds:[rax+0x4]{eh}, zmm26 vpackstoreld byte ptr ds:[rax+0x1]{eh}, zmm2{uint8} vpackstoreld byte ptr ds:[rax+0x1]{eh}, zmm2{sint8} vpackstoreld word ptr ds:[rax+0x2]{eh}, zmm2{uint16} vpackstoreld word ptr ds:[rax+0x2]{eh}, zmm2{sint16} ``` -------------------------------- ### VFMADD213PD with Register Operands (Example) Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Masm/Test64_MemDefault.txt A specific example of VFMADD213PD with register operands. ```Assembly vfmsub213pd zmm2,zmm22,zmm27{ru-sae} ``` ```Assembly vfmsub213pd zmm2,zmm30,zmm3{rz-sae} ``` -------------------------------- ### VPACKSTORELPD Instructions Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Fast/Test64_Inverted.txt Shows VPACKSTORELPD instructions for packing and storing packed double-precision floating-point data. Includes variations with masking and rounding. ```assembly vpackstorelpd qword ptr ds:[rax+0x8]{k5}, zmm2 vpackstorelpd qword ptr ds:[rax+0x8]{eh}, zmm26 ``` -------------------------------- ### Move Code in Memory (Hooking a Function) - Rust Source: https://github.com/icedland/iced/blob/master/src/rust/iced-x86/README.md This example demonstrates how to move code in memory to hook a function. It decodes instructions from an original address and re-encodes them starting at a new address, inserting a jump to the programmer's code. It uses `BlockEncoder` to handle potential issues like short branches needing to become longer. Ensure allocated memory is within +/-2GB for RIP-relative addressing in 64-bit mode. ```rust use iced_x86::{ BlockEncoder, BlockEncoderOptions, Code, Decoder, DecoderOptions, FlowControl, Formatter, IcedError, Instruction, InstructionBlock, NasmFormatter, OpKind, }; // Decodes instructions from some address, then encodes them starting at some // other address. This can be used to hook a function. You decode enough instructions // until you have enough bytes to add a JMP instruction that jumps to your code. // Your code will then conditionally jump to the original code that you re-encoded. // // This code uses the BlockEncoder which will help with some things, eg. converting // short branches to longer branches if the target is too far away. // // 64-bit mode also supports RIP relative addressing, but the encoder can't rewrite // those to use a longer displacement. If any of the moved instructions have RIP // relative addressing and it tries to access data too far away, the encoder will fail. // The easiest solution is to use OS alloc functions that allocate memory close to the // original code (+/-2GB). /* This method produces the following output: Original code: 00007FFAC46ACDA4 mov [rsp+10h],rbx 00007FFAC46ACDA9 mov [rsp+18h],rsi 00007FFAC46ACDAE push rbp 00007FFAC46ACDAF push rdi 00007FFAC46ACDB0 push r14 00007FFAC46ACDB2 lea rbp,[rsp-100h] 00007FFAC46ACDBA sub rsp,200h 00007FFAC46ACDC1 mov rax,[rel 7FFAC47524E0h] 00007FFAC46ACDC8 xor rax,rsp 00007FFAC46ACDCB mov [rbp+0F0h],rax 00007FFAC46ACDD2 mov r8,[rel 7FFAC474F208h] 00007FFAC46ACDD9 lea rax,[rel 7FFAC46F4A58h] 00007FFAC46ACDE0 xor edi,edi Original + patched code: 00007FFAC46ACDA4 mov rax,123456789ABCDEF0h 00007FFAC46ACDAE jmp rax 00007FFAC46ACDB0 push r14 00007FFAC46ACDB2 lea rbp,[rsp-100h] 00007FFAC46ACDBA sub rsp,200h 00007FFAC46ACDC1 mov rax,[rel 7FFAC47524E0h] 00007FFAC46ACDC8 xor rax,rsp 00007FFAC46ACDCB mov [rbp+0F0h],rax 00007FFAC46ACDD2 mov r8,[rel 7FFAC474F208h] 00007FFAC46ACDD9 lea rax,[rel 7FFAC46F4A58h] 00007FFAC46ACDE0 xor edi,edi Moved code: 00007FFAC48ACDA4 mov [rsp+10h],rbx 00007FFAC48ACDA9 mov [rsp+18h],rsi 00007FFAC48ACDAE push rbp 00007FFAC48ACDAF push rdi 00007FFAC48ACDB0 jmp 00007FFAC46ACDB0h */ #[allow(dead_code)] pub(crate) fn how_to_move_code() -> Result<(), IcedError> { let example_code = EXAMPLE_CODE.to_vec(); println!("Original code:"); disassemble(&example_code, EXAMPLE_CODE_RIP); let mut decoder = Decoder::with_ip( EXAMPLE_CODE_BITNESS, &example_code, EXAMPLE_CODE_RIP, DecoderOptions::NONE, ); // In 64-bit mode, we need 12 bytes to jump to any address: // mov rax,imm64 // 10 // jmp rax // 2 // We overwrite rax because it's probably not used by the called function. // In 32-bit mode, a normal JMP is just 5 bytes let required_bytes = 10 + 2; let mut total_bytes = 0; let mut orig_instructions: Vec = Vec::new(); for instr in &mut decoder { orig_instructions.push(instr); total_bytes += instr.len() as u32; if instr.is_invalid() { panic!("Found garbage"); } if total_bytes >= required_bytes { break; } match instr.flow_control() { FlowControl::Next => {} FlowControl::UnconditionalBranch => { if instr.op0_kind() == OpKind::NearBranch64 { let _target = instr.near_branch_target(); // You could check if it's just jumping forward a few bytes and follow it // but this is a simple example so we'll fail. } panic!("Not supported by this simple example"); } FlowControl::IndirectBranch | FlowControl::ConditionalBranch | FlowControl::Return | FlowControl::Call | FlowControl::IndirectCall | FlowControl::Interrupt | FlowControl::XbeginXabortXend | FlowControl::Exception => panic!("Not supported by this simple example"), } } if total_bytes < required_bytes { panic!("Not enough bytes!"); } assert!(!orig_instructions.is_empty()); // Create a JMP instruction that branches to the original code, except those instructions // that we'll re-encode. We don't need to do it if it already ends in 'ret' let (jmp_back_addr, add) = { let last_instr = orig_instructions.last().unwrap(); if last_instr.flow_control() != FlowControl::Return { (last_instr.next_ip(), true) } else { (last_instr.next_ip(), false) } }; if add { orig_instructions.push(Instruction::with_branch(Code::Jmp_rel32_64, jmp_back_addr)?); } // Relocate the code to some new location. It can fix short/near branches and ``` -------------------------------- ### vpandnq Examples (Intel Syntax, Gas) Source: https://github.com/icedland/iced/blob/master/src/UnitTests/Intel/Formatter/Gas/Test64_ForceSuffix.txt Provides examples of the vpandnq instruction, showcasing different memory addressing and element size combinations. Note the {eh} and {k3} specifiers. ```assembly vpandnq 0x40(rax), zmm6, zmm2 ``` ```assembly vpandnq 8(rax){1to8}, zmm6, zmm10 ``` ```assembly vpandnq 0x20(rax){4to8}, zmm6, zmm18 ``` ```assembly vpandnq 0x40(rax){eh}, zmm6, zmm2 ``` ```assembly vpandnq 8(rax){eh}{1to8}, zmm6, zmm2 ``` ```assembly vpandnq 0x20(rax){eh}{4to8}, zmm6, zmm2 ``` ```assembly vpandnq zmm3, zmm6, zmm2 ``` ```assembly vpandnq zmm3{cdab}, zmm6, zmm10{k3} ``` ```assembly vpandnq zmm3{badc}, zmm6, zmm18 ``` ```assembly vpandnq zmm3{dacb}, zmm6, zmm26 ``` ```assembly vpandnq zmm11{aaaa}, zmm6, zmm2 ``` ```assembly vpandnq zmm19{bbbb}, zmm6, zmm2 ``` ```assembly vpandnq zmm27{cccc}, zmm6, zmm2 ``` ```assembly vpandnq zmm3{dddd}, zmm6, zmm2 ``` -------------------------------- ### Example 64-bit Code Source: https://github.com/icedland/iced/blob/master/src/java/iced-x86/README.md A byte array representing a 64-bit code example. This can be used for disassembling or encoding. ```Java static final int exampleCodeBitness = 64; static final long exampleCodeRIP = 0x00007FFAC46ACDA4L; static final byte[] exampleCode = new byte[] { (byte)0x48, (byte)0x89, (byte)0x5C, (byte)0x24, (byte)0x10, (byte)0x48, (byte)0x89, (byte)0x74, (byte)0x24, (byte)0x18, (byte)0x55, (byte)0x57, (byte)0x41, (byte)0x56, (byte)0x48, (byte)0x8D, (byte)0xAC, (byte)0x24, (byte)0x00, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0x48, (byte)0x81, (byte)0xEC, (byte)0x00, (byte)0x02, (byte)0x00, (byte)0x00, (byte)0x48, (byte)0x8B, (byte)0x05, (byte)0x18, (byte)0x57, (byte)0x0A, (byte)0x00, (byte)0x48, (byte)0x33, (byte)0xC4, (byte)0x48, (byte)0x89, (byte)0x85, (byte)0xF0, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x4C, (byte)0x8B, (byte)0x05, (byte)0x2F, (byte)0x24, (byte)0x0A, (byte)0x00, (byte)0x48, (byte)0x8D, (byte)0x05, (byte)0x78, (byte)0x7C, (byte)0x04, (byte)0x00, (byte)0x33, (byte)0xFF, }; } ``` -------------------------------- ### Install iced-x86 with pip Source: https://context7.com/icedland/iced/llms.txt Install the iced-x86 Python package using pip. This command ensures you have the latest version. ```bash python3 -m pip install -U iced-x86 ```