{"action":"closed","issue":{"url":"https://api.github.com/repos/zyantific/zydis/issues/39","repository_url":"https://api.github.com/repos/zyantific/zydis","labels_url":"https://api.github.com/repos/zyantific/zydis/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/zyantific/zydis/issues/39/comments","events_url":"https://api.github.com/repos/zyantific/zydis/issues/39/events","html_url":"https://github.com/zyantific/zydis/issues/39","id":324773749,"number":39,"title":"Bad instruction and asserts","user":{"login":"gdbinit","id":859134,"avatar_url":"https://avatars1.githubusercontent.com/u/859134?v=4","gravatar_id":"","url":"https://api.github.com/users/gdbinit","html_url":"https://github.com/gdbinit","followers_url":"https://api.github.com/users/gdbinit/followers","following_url":"https://api.github.com/users/gdbinit/following{/other_user}","gists_url":"https://api.github.com/users/gdbinit/gists{/gist_id}","starred_url":"https://api.github.com/users/gdbinit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdbinit/subscriptions","organizations_url":"https://api.github.com/users/gdbinit/orgs","repos_url":"https://api.github.com/users/gdbinit/repos","events_url":"https://api.github.com/users/gdbinit/events{/privacy}","received_events_url":"https://api.github.com/users/gdbinit/received_events","type":"User","site_admin":false},"labels":[{"id":141263511,"url":"https://api.github.com/repos/zyantific/zydis/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-21T03:08:02Z","updated_at":"2018-05-21T14:02:55Z","closed_at":"2018-05-21T14:02:54Z","author_association":"NONE","body":"Hi,\r\n\r\nGetting an assert on the following bytes: 64 62 b1 f8 0d 18 31\r\nAssertion failed: (instruction->operandCount >= 2), function ZydisDecodeOperands, file /Users/xxxxx/zydis/src/Decoder.c, line 2006. A few variations of the last byte also produce the same result.\r\n\r\nThe core question is if asserts are to stay in the code base or they will be removed in the near future? The reason is that I am mass analysing potentially hostile binaries and getting into weird decodings like this and that will crash my daemon, unless I write something to intercept those assertions and recover from them. \r\n\r\nAre these kind of instructions interesting to you to return proper errors? I'll probably land into a bunch of them on my side.\r\n\r\nBest,\r\nPedro\r\n\r\nP.S.: sort of ignore the asserts as development feature since I just saw I asked that long time ago in another bug. In this particular case I fixed the assert into a test for operandCount < 2 and return a ZYDIS_STATUS_DECODING_ERROR if true. Might be better than the assert but didn't really check the EVX instructions to see if it's the best solution."}}
{"actor":{"display_login":"athre0z"}}