Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to disassemble specific instruction in RISCV #2278

Closed
trojanwarriors opened this issue Feb 21, 2024 · 7 comments
Closed

Unable to disassemble specific instruction in RISCV #2278

trojanwarriors opened this issue Feb 21, 2024 · 7 comments
Labels
outdated-module Issue due to an outdated arch module RISCV Arch
Milestone

Comments

@trojanwarriors
Copy link

trojanwarriors commented Feb 21, 2024

I tried to disassemble a specific instruction, and Capstone couldn't return with the correct output
The following Python code reproduces the error:

# test1.py
from capstone import *

md = Cs(CS_ARCH_RISCV, CS_MODE_RISCVC)

# 1001 0100 0010 0101 0011 0101 0000 0011
# (1001 0100 0010) (0101 0)(011) (0101 0)000 0011
# ld x10, -1726(x10)
# 0x94253503

CODE = b"\x03\x35\x25\x94"
print("First instruction: ")
for i in md.disasm(CODE, 0x00000690):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

CODE = b"\x03\x25\x35\x94"
print("Second instruction: ")
for i in md.disasm(CODE, 0x00000690):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output shows that only the second instruction could be disassembled:
2024-02-21_13-04

@trojanwarriors trojanwarriors changed the title Unable to decompile specific instruction Unable to decompile specific instruction in RISCV Feb 21, 2024
@trojanwarriors
Copy link
Author

another instruction: 0x63cd3d03 -> ld x26, 1596(x26). It seems it is affecting LD instructions. The interesting part is that tools like ROPGadget can disassemble it correctly.

@trojanwarriors trojanwarriors changed the title Unable to decompile specific instruction in RISCV Unable to disassemble specific instruction in RISCV Feb 21, 2024
@Rot127
Copy link
Collaborator

Rot127 commented Feb 22, 2024

Unfortunately, the RISCV module is still not updated and is at the level of LLVM 7. This is likely why it isn't decoding it.
Checkout #2015 for any progress in this regard.

@Rot127 Rot127 added RISCV Arch outdated-module Issue due to an outdated arch module labels Mar 19, 2024
@Rot127 Rot127 added this to the v6 milestone Mar 19, 2024
@Rot127 Rot127 moved this to Todo in Capstone V6 Plan Mar 20, 2024
@trojanwarriors
Copy link
Author

I am sorry. I couldn't find a way to send a private message to you, Rot127, so I am sending it here. Can I work to fix this issue? I just saw a Kaban-like dashboard after clicking the link Capstone V6 Plan. How does the collaboration work?

@Rot127
Copy link
Collaborator

Rot127 commented Mar 21, 2024

Can you ping me in the Telegram channel of Capstone, please?

@Rot127
Copy link
Collaborator

Rot127 commented Mar 21, 2024

If you can't use Telegram I would write something properly out for RISCV, but it will take a day or two.

@Rot127
Copy link
Collaborator

Rot127 commented Mar 25, 2024

@trojanwarriors There is the idea to generate the RISCV module not from LLVM, but use SAIL. Because the definitions have way better quality.
So please ping us before starting to work on anything.

@trojanwarriors
Copy link
Author

It is working now with CS_MODE_RISCV64 instead of CS_MODE_RISCVC. Great!

@Rot127 Rot127 closed this as completed Jul 26, 2024
@github-project-automation github-project-automation bot moved this from Todo to Done in Capstone V6 Plan Jul 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
outdated-module Issue due to an outdated arch module RISCV Arch
Projects
Status: Done
Development

No branches or pull requests

2 participants