Skip to content

Add support for the x86 HRESET instruction #2693

Description

@stevenjoezhang

Feature

  • New architecture module
  • Support for processor extension
  • Add more instruction details (elaborated below)
  • Binding support for: language
  • Other (elaborated below)

Describe the feature you'd like

The HRESET instruction is used by the Windows 11 24H2 kernel's SwapContext routine, but it is not currently recognized by Capstone. Here is a screenshot from WinDbg:

Image

Running cstool:

$ cstool x64 "48 55 48 83 EC 30 0F 0D 4E 71 88 4C 24 28 80 7E 71 00 0F 85 46 06 00 00 C6 46 71 01 8B 05 A2 9D 94 00 85 C0 74 06 F3 0F 3A F0 C0 00"
 0  48 55                                            push       rbp
 2  48 83 ec 30                                      sub        rsp, 0x30
 6  0f 0d 4e 71                                      prefetchw  byte ptr [rsi + 0x71]
 a  88 4c 24 28                                      mov        byte ptr [rsp + 0x28], cl
 e  80 7e 71 00                                      cmp        byte ptr [rsi + 0x71], 0
12  0f 85 46 06 00 00                                jne        0x65e
18  c6 46 71 01                                      mov        byte ptr [rsi + 0x71], 1
1c  8b 05 a2 9d 94 00                                mov        eax, dword ptr [rip + 0x949da2]
22  85 c0                                            test       eax, eax
24  74 06                                            je 0x2c

As you can see, F3 0F 3A F0 C0 00 is not recognized as HRESET.

I noticed LLVM has already added a definition for HRESET in X86InstrMisc.td at line 1624 , but Capstone's TableGen sources (https://github.com/capstone-engine/capstone/tree/next/suite/synctools/tablegen/X86) are still based on an older opcode list and lack HRESET

Additional context

Thank you for considering this addition, supporting HRESET will enable accurate disassembly of modern Windows kernels and other software targeting newer CPUs.
I'm happy to help with testing or providing test cases.

Metadata

Metadata

Assignees

No one assigned

    Labels

    X86Archoutdated-moduleIssue due to an outdated arch module

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions