本文介绍了在X86代码中插入未定义的指令,以供Intel PIN检测的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!

问题描述

我正在使用基于 PIN 的模拟器来测试一些新的体系结构修改.我需要使用模拟器测试带有两个操作数(寄存器和内存位置)的新"指令.

I'm using a PIN based simulator to test some new architectural modifications. I need to test a "new" instruction with two operands (a register and a memory location) using my simulator.

由于使用GCC机器描述仅添加一条指令很繁琐,因此使用NOP或未定义指令似乎合乎逻辑. PIN 可以使用INS_IsNop轻松检测到NOP指令,但是会干扰自然添加到代码中的NOP,它也没有操作数或只有一个内存操作数.

Since it's tedious to use GCC Machine description to add only one instructions it seemed logical to use NOPs or Undefined Instructions. PIN would easily be able to detect a NOP instruction using INS_IsNop, but it would interfere with NOPs added naturally to the code, It also has either no operands or a single memory operand.

剩下的唯一选择是使用未定义的指令.未定义的指令将永远不会干扰其余代码,可以通过 PIN 使用INS_IsInvalid进行检测.

The only option left is to use and undefined instruction. undefined instructions would never interfere with the rest of the code, and can be detected by PIN using INS_IsInvalid.

问题是我不知道如何使用GCC内联汇编添加未定义的指令(带有操作数).我该怎么办?

The problem is I don't know how to add an undefined instruction (with operands) using GCC inline assembly. How do I do that?

推荐答案

因此,事实证明x86具有明确的未知指令"(请参见). gcc可以通过简单地使用以下方法来产生此结果:

So it turns out that x86 has an explicit "unknown instruction" (see this). gcc can produce this by simply using:

asm("ud2");

对于带有操作数的未定义指令,我不确定这是什么意思.拥有未定义的操作码后,所有其他字节都将变为未定义.

As for an undefined instruction with operands, I'm not sure what that would mean. Once you have an undefined opcode, the additional bytes are all undefined.

但是也许您可以通过以下方式获得想要的东西:

But maybe you can get what you want with something like:

asm(".byte 0x0f, 0x0b");

这篇关于在X86代码中插入未定义的指令,以供Intel PIN检测的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持!

09-16 06:40