Feature
Describe the feature you'd like
The HRESET instruction is used by the Windows 11 24H2 kernel's SwapContext routine, but it is not currently recognized by Capstone. Here is a screenshot from WinDbg:
Running cstool:
$ cstool x64 "48 55 48 83 EC 30 0F 0D 4E 71 88 4C 24 28 80 7E 71 00 0F 85 46 06 00 00 C6 46 71 01 8B 05 A2 9D 94 00 85 C0 74 06 F3 0F 3A F0 C0 00"
0 48 55 push rbp
2 48 83 ec 30 sub rsp, 0x30
6 0f 0d 4e 71 prefetchw byte ptr [rsi + 0x71]
a 88 4c 24 28 mov byte ptr [rsp + 0x28], cl
e 80 7e 71 00 cmp byte ptr [rsi + 0x71], 0
12 0f 85 46 06 00 00 jne 0x65e
18 c6 46 71 01 mov byte ptr [rsi + 0x71], 1
1c 8b 05 a2 9d 94 00 mov eax, dword ptr [rip + 0x949da2]
22 85 c0 test eax, eax
24 74 06 je 0x2c
As you can see, F3 0F 3A F0 C0 00 is not recognized as HRESET.
I noticed LLVM has already added a definition for HRESET in X86InstrMisc.td at line 1624 , but Capstone's TableGen sources (https://github.com/capstone-engine/capstone/tree/next/suite/synctools/tablegen/X86) are still based on an older opcode list and lack HRESET
Additional context
Thank you for considering this addition, supporting HRESET will enable accurate disassembly of modern Windows kernels and other software targeting newer CPUs.
I'm happy to help with testing or providing test cases.
Feature
languageDescribe the feature you'd like
The HRESET instruction is used by the Windows 11 24H2 kernel's SwapContext routine, but it is not currently recognized by Capstone. Here is a screenshot from WinDbg:
Running cstool:
As you can see,
F3 0F 3A F0 C0 00is not recognized as HRESET.I noticed LLVM has already added a definition for HRESET in X86InstrMisc.td at line 1624 , but Capstone's TableGen sources (https://github.com/capstone-engine/capstone/tree/next/suite/synctools/tablegen/X86) are still based on an older opcode list and lack HRESET
Additional context
Thank you for considering this addition, supporting HRESET will enable accurate disassembly of modern Windows kernels and other software targeting newer CPUs.
I'm happy to help with testing or providing test cases.