Bddisasm Versions Save

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.

v2.1.4

1 month ago
  • Removed no longer needed static assert, that caused build errors.

v2.1.3

1 month ago
  • Aligned BDDISASM APX instructions syntax with some of the Intel recommendations (using the suffix notation for NF and ZU indications, using finite set notation for DFV operands).
  • The ZU indication is appended as a mnemonic suffix, as per recomandations. However, in case of SETcc instructions, BDDISASM will append the ZU indication AFTER the condition code (similar to CMPccXADD and with initial SETcc.ZU specification).
  • The DFV (default flags value) operand obeys the finite set notation, but it is placed as the last operand of the instruction.
  • Added Read access for the rIP operand for the SYSCALL instruction.
  • Added SCS, rCX, rDX operands for the SYSEXIT instruction.
  • Added Read access for the rIP operand for some CALL instructions.

v2.1.0

2 months ago

Added support in BDDISASM for multiple new Intel extensions: REX2, APX, USERMSR. Added support in BDSHEMU for some REX2 and APX instructions. Added support in BDSHEMU for loop tracking & direct shellcode emulation. Reduced the size of the INSTRUX structure, and improved decoding performance. New decoding option allow to skip implicit operands from being decoded. Re-worked the Python isagenerator scripts. More info about the changes in this version can be consulted in the CHANGELOG.

v1.37.0

1 year ago

Added support for Intel AMX-COMPLEX instructions. Added support for AMD RMPQUERY instruction. Added support for new Intel instructions, per Intel ISA extensions document #319433-046 (September 2022): PREFETCHITI, RAO-INT, CMPCCXADD, WRMSRNS, MSRLIST, AMX-FP16, AVX-IFMA, AVX-NE-CONVERT, AVX-VNNI-INT8. Switched to a more parsing-friendly format for the instructions database, where individual components are sepparated by a semicolon. Improved comments & improved vector length specifiers.

v1.34.10

2 years ago
  • Switched to internally defined types.
  • WRUSSD and WRUSSQ cannot be executed when CPL != 0.
  • Fixed High8 handling in NdGetFullAccessMap.
  • Improved REG_ID macros - make sure we include block addressing and High8 designator in the reg ID. Alsom, make sure the register size fits in, since the new tile register can be 1K in size, which previously overflowed...

v1.34.7

2 years ago

Support for RDTSC in bdshemu. Implemented a reverse operand lookup table. It holds pointers to relevant operands inside INSTRUX, for quick lookup. Moved helper functions in bdhelpers.c. Added a dedicated BranchInfo field inside INSTRUX, containing the most relevant branch information.

v1.34.4

2 years ago

Multiple improvements

  • New shemu flag - SHEMU_FLAG_SIDT, set when sheu encounters a SIDT in ring0.
  • Added the CET Tracked flag to SYSCLAL, SYSENTER and INT n instructions.
  • Fixed Do Not Track prefix recognition for CALL and JMP in long-mode.
  • Fixed MONITOR and MONITORX implicit operands - the rAX register encodes a virtual address that will be used as the monitored range. That address is subject to a 1 byte load.
  • Fixed RMPADJUST and RMPUPDATE implicit operands - the rAX register encodes a virtual address, and the rCX register encodes a virtual address of the RMP updated entry.

v1.34.2

2 years ago

v1.34.2 New shellcode flag - call tot Wow32 reserved. New shellcode flag - heaven's gate. New shellcode flag - stack-pivot. Moved bdshemu tests in a password protected zip file, so it doesn't trigger AV detections. Fixed an emulation bug for MOVZX and MOVSX instructions (https://github.com/bitdefender/bddisasm/issues/48) Fixed NEG emulation - make sure flags are set. Added new shemu flag: SHEMU_FLAG_SUD_ACCESS is raised whenever the code accesses the SharedUserData page.

v1.33.0

2 years ago

v1.32.1

3 years ago

Changelog:

  • Added support for Intel FRED and LKGS instructions
  • Improved CMake build and install process:
    • Users no longer need to implement nd_vsnprintf_s and nd_memset (the old behavior can be enabled at build time)
    • Easier integration with other CMake projects: just use find_package/add_subdirectory/FetchContent and link against bddisasm::bddisasm or bddisasm::bdshemu