1

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction:

from capstone import *
from capstone.x86 import *

md = Cs(CS_ARCH_X86, CS_MODE_64)
md.detail = True

#instruction_bytes = b'b\x11\r(\xfe\xf6'
# The above instruction_bytes work as expected, the below print shows
# 0x6: vpaddd ymm14 , ymm14, ymm30               62110d28fef6

instruction_bytes = b'b\xf3}(C\xe4\x03'
# Capstone has problem with the above instruction_bytes.
# IDA Pro shows the instruction vshufi32x4 ymm4, ymm0, ymm4, 3

print(instruction_bytes.hex())  # '62f37d2843e403'
for c_i in md.disasm(instruction_bytes, len(instruction_bytes)):
    print(hex(c_i.address) + ":", c_i.mnemonic, c_i.op_str, "\t\t\t\t", c_i.bytes.hex())

Other examples which cannot be disassembled by Capstone are vpunpcklqdq and vprold

What is so special about these instructions? How can I make Capstone disassemble them?

1 Answer 1

1

Reading through the issues in the Capstone repo, there seems to have been some problems/regressions with decoding AVX-512 instructions for the last couple of years:

https://github.com/capstone-engine/capstone/issues?q=is%3Aissue+avx

You could try building capstone from next and see if that works:

https://github.com/capstone-engine/capstone/tree/next

1
  • Using the next branch solved the problem. Jul 15 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.