Skip to content

Conversation

@jxors
Copy link

@jxors jxors commented Nov 20, 2025

Your checklist for this pull request

  • I've documented or updated the documentation of every API function and struct this PR changes.
  • I've added tests that prove my fix is effective or that my feature works (if possible)

Detailed description

This draft PR attempts to fix the decoding of x64 instructions with ignored segment overrides. The typical behavior of CPUs, which is copied by most disassemblers, is to completely ignore ES/CS/SS/DS segment overrides and use the last FS/GS override, if any.

...

Test plan

As requested by @Rot127 this is a draft to quickly see if any tests fail. I have not yet added any new tests.

In particular I am unsure about whether my changes correctly cover the cases where 26 and 36 are used as branch (not) taken hints rather than segment overrides.

...

closes #2818

...

@Rot127
Copy link
Collaborator

Rot127 commented Nov 20, 2025

Seems to not break anything.
I need to read into it a little though. But generally looks good.

@hainest
Copy link
Contributor

hainest commented Nov 20, 2025

This is going to need a fair bit of testing. In particular, for multiple segment overrides in 32-bit mode all of the disassemblers (including Capstone) use first-seen. We'll want to make sure that is unchanged. I'm happy to help write a few tests cases.

@jxors
Copy link
Author

jxors commented Nov 21, 2025

I'm happy to help write a few tests cases.

Thank you! This is my first time working with the capstone codebase, so I appreciate all help/advice.

I am reading up on Capstone's testing set up and I will try to write a few tests myself as well.

@Rot127 Rot127 marked this pull request as draft November 24, 2025 11:48
@Rot127
Copy link
Collaborator

Rot127 commented Nov 24, 2025

Mark this as draft for now. Please change it back once you think the testing is enough.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

X86 Arch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

x64: es/cs/ss/ds segment override prefixes should be ignored

3 participants