Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Conversation

hainest
Copy link
Contributor

@hainest hainest commented Oct 14, 2025

Your checklist for this pull request

  • I've documented or updated the documentation of every API function and struct this PR changes.
  • I've added tests that prove my fix is effective or that my feature works (if possible)

Detailed description

Add read/written registers for loop, loope, and loopne instructions.

Test plan

Tests are included.


This fixes a bug in 64-bit mode where eip and ecx are read/written instead of rip and rcx. However, it introduces the bug that using the size prefix override (e.g., 0x67e210) still reads/writes rip and rcx instead of eip and ecx. There is currently no way to solve this issue because insn->detail->x86.prefixes isn't populated at the time when the register translation is happening in X86_get_insn_id.

This fixes a bug in 64-bit mode where eip and ecx are read/written
instead of rip and rcx. However, it introduces the bug that using the
size prefix override (0x67e210) still reads/writes rip and rcx instead
of eip and ecx. There is currently no way to solve this issue because
'insn->detail->x86.prefixes' isn't populated at the time when the
register translation is happening in 'X86_get_insn_id'.
When the address size prefix override is present, 'rcx' is incorrectly
reported as being read/written instead of 'ecx'.
As with loope when the address size prefix override is present, 'rcx'
is incorrectly reported as being read/written instead of 'ecx'.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Morty Proxy This is a proxified and sanitized view of the page, visit original site.