├── .gitattributes ├── LICENSE ├── README.md ├── cpuDuck.cpp └── duck.asm /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2022 Huoji's 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ### AMD CPU与INTEL CPU指令解析问题 2 | 假设一个情况: 3 | ```cpp 4 | 66 e8 00 00 00 00 5 | ``` 6 | 在x86指令集中 7 | 66会作为e8的prefix,覆盖code segment size 8 | 假设当前大小为16bit 新大小会为32bit.反之一样. 9 | 10 | code segment size由 GDT/LDT 决定.实模式一般是16 bit("unreal"模式除外) 11 | 12 | 在x64中,我发现了一个很有意思的地方: 13 | 66 E8作为指令前缀时,AMD和INTEL呈现了完全不同的特性,即amd会遵循规则,将e8的code segment size设置为16bit 而intel则直接忽略. 14 | 15 | 这个问题已经被发现了有一段时间了,capstone在2016年,记录了这个问题. 16 | https://github.com/capstone-engine/capstone/issues/776 17 | 18 | 这是一个概念性代码,不用CPUID判断出是INTEL还是AMD的cpu. 19 | 20 | ### 简单的思考: 21 | 能否用于混淆? 22 | -------------------------------------------------------------------------------- /cpuDuck.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | extern "C" void asm_fake_jmp(); 4 | extern "C" void fake_jmp_end(); 5 | void fake_jmp_end() { 6 | printf("you are intel cpu \n"); 7 | } 8 | 9 | int main() 10 | { 11 | __try 12 | { 13 | asm_fake_jmp(); 14 | } 15 | __except (1) 16 | { 17 | printf("you are amd cpu \n"); 18 | } 19 | system("pause"); 20 | } -------------------------------------------------------------------------------- /duck.asm: -------------------------------------------------------------------------------- 1 | .code 2 | extern fake_jmp_end:proc 3 | 4 | asm_fake_jmp proc 5 | ;int 3; 6 | db 66h 7 | db 0E9h 8 | db 00h 9 | db 00h 10 | db 00h 11 | db 00h 12 | db 90h 13 | db 90h 14 | db 90h 15 | jmp fake_jmp_end 16 | ret 17 | ;jmp fake_jmp_end 18 | asm_fake_jmp endp 19 | 20 | end --------------------------------------------------------------------------------