{"action":"created","issue":{"url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/381","repository_url":"https://api.github.com/repos/JonathanSalwan/Triton","labels_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/381/labels{/name}","comments_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/381/comments","events_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/381/events","html_url":"https://github.com/JonathanSalwan/Triton/issues/381","id":175013789,"number":381,"title":"sematics of movs","user":{"login":"tovain10071991","id":3599157,"avatar_url":"https://avatars.githubusercontent.com/u/3599157?v=3","gravatar_id":"","url":"https://api.github.com/users/tovain10071991","html_url":"https://github.com/tovain10071991","followers_url":"https://api.github.com/users/tovain10071991/followers","following_url":"https://api.github.com/users/tovain10071991/following{/other_user}","gists_url":"https://api.github.com/users/tovain10071991/gists{/gist_id}","starred_url":"https://api.github.com/users/tovain10071991/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tovain10071991/subscriptions","organizations_url":"https://api.github.com/users/tovain10071991/orgs","repos_url":"https://api.github.com/users/tovain10071991/repos","events_url":"https://api.github.com/users/tovain10071991/events{/privacy}","received_events_url":"https://api.github.com/users/tovain10071991/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-05T07:49:19Z","updated_at":"2016-09-05T09:40:41Z","closed_at":null,"body":"the test case as follow:\r\n```\r\n.section .data\r\ninput:\r\n  .asciz \"AAAAAAA\"\r\nbuf:\r\n  .asciz \"BBBBBBB\"\r\n.section .text\r\n.global _start\r\n_start:\r\n  movq $buf, %rdi\r\n  movq $input, %rsi\r\n  movsq %ds:(%rsi), %es:(%rdi)\r\n  call exit\r\n```\r\n\r\nrun `as` and `ld` in ubuntu 14.04 64bit.\r\n\r\nthe disassembly codes as follow:\r\n```\r\n0x400230<_start>:\r\n  mov $0x6003b0, %rdi                   => the base of buf is 0x6003b0\r\n  mov $0x6003a8, %rsi                    => the base of input is 0x6003a8\r\n  movsq %ds:(%rsi), %es:(%rdi)\r\n  callq exit@plt\r\n```\r\n\r\nthe trition pin script as follow:\r\n```\r\nfrom triton import *\r\nfrom pintool import *\r\n\r\ndef before_inst(inst):\r\n  if inst.getAddress() == 0x400230:\r\n  for add in range(0x6003a8, 0x6003b0):                 # make input tainted\r\n    taintMemory(addr)\r\n\r\n  print inst\r\n  print 'is tainted: %d' % inst.isTainted()\r\n  for se in inst.getSymbolicExpressions():\r\n    print se\r\n\r\nif __name__ == '__main__':\r\n  setArchitecture(ARCH.X86_64)\r\n  startAnalysisFromEntry()\r\n  stopAnalysisFromAddress(0x400240)\r\n  insertCall(before_inst, INSERT_POINT.BEFORE)\r\n  runProgram()\r\n```\r\n\r\nrun triton with the script.\r\n\r\nthe result as follow:\r\n```\r\n40023e: movsq qword ptr [rdi], qword ptr [rsi]\r\nis tainted: 0\r\nref!4 = ((_ extract 63 56) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!5 = ((_ extract 55 48) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!6 = ((_ extract 47 40) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!7 = ((_ extract 39 32) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!8 = ((_ extract 31 24) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!9 = ((_ extract 23 16) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!10 = ((_ extract 15 8) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!11 = ((_ extract 7 0) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ; Byte reference - MOVSQ operation\r\nref!12 = (concat ((_ extract 63 56) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 55 48) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 47 40) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 39 32) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 31 24) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 23 16) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 15 8) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)))) ((_ extract 7 0) (concat ((_ extract 7 0) (_ bv0 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8)) ((_ extract 7 0) (_ bv66 8))))) ; Temporary concatenation reference - MOVSQ operation\r\n...\r\n```\r\n\r\nthe `ref!4`~`ref!12` are from `buf` known form `bv66` and inst is not tainted.\r\n\r\nif I modify `for add in range(0x6003a8, 0x6003b0)` in script into `for add in range(0x6003b0, 0x6003b8)`, the result is that the inst is tainted and the expressions are stil related with `buf`.\r\n\r\nI want to know if the sematics of `movs` is fault. I want `ref!4`~`ref!12` to be related with `input`.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/comments/244704410","html_url":"https://github.com/JonathanSalwan/Triton/issues/381#issuecomment-244704410","issue_url":"https://api.github.com/repos/JonathanSalwan/Triton/issues/381","id":244704410,"user":{"login":"JonathanSalwan","id":991046,"avatar_url":"https://avatars.githubusercontent.com/u/991046?v=3","gravatar_id":"","url":"https://api.github.com/users/JonathanSalwan","html_url":"https://github.com/JonathanSalwan","followers_url":"https://api.github.com/users/JonathanSalwan/followers","following_url":"https://api.github.com/users/JonathanSalwan/following{/other_user}","gists_url":"https://api.github.com/users/JonathanSalwan/gists{/gist_id}","starred_url":"https://api.github.com/users/JonathanSalwan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonathanSalwan/subscriptions","organizations_url":"https://api.github.com/users/JonathanSalwan/orgs","repos_url":"https://api.github.com/users/JonathanSalwan/repos","events_url":"https://api.github.com/users/JonathanSalwan/events{/privacy}","received_events_url":"https://api.github.com/users/JonathanSalwan/received_events","type":"User","site_admin":false},"created_at":"2016-09-05T09:40:41Z","updated_at":"2016-09-05T09:40:41Z","body":"Hey,\r\n\r\nThanks for this report.\r\n\r\n> I find out the fact that the operand 0 and 1 of movsq respectively are source memory address and destination memory address but in movsq_s() function, read operands inversely. [...] I don't know if my discovery is right and I don't know which other instructions have the same problem.\r\n\r\nWell, actually, you are wrong and right! The order of operands in semantics are based on the Intel syntax, so the operand 0 is the dest and the operand 1 is the source. However, they are inverted like you said but it's not related to the semantics part. Actually, the bug is located between the sync with Triton and the pintool.\r\n\r\nTo resume, the bug only occurs if:\r\n\r\n* You use the pintool\r\n* The instruction perform more than two memory access with a different source and destination.\r\n\r\nI will try to fix this asap :)\r\n"}}
{"actor":{"display_login":"JonathanSalwan"}}