diff options
Diffstat (limited to 'results/classifier/zero-shot/010/semantic')
6 files changed, 343 insertions, 0 deletions
diff --git a/results/classifier/zero-shot/010/semantic/gitlab_semantic_addsubps b/results/classifier/zero-shot/010/semantic/gitlab_semantic_addsubps new file mode 100644 index 00000000..165411cb --- /dev/null +++ b/results/classifier/zero-shot/010/semantic/gitlab_semantic_addsubps @@ -0,0 +1,52 @@ +semantic: 0.974 +device: 0.758 +other: 0.732 +graphic: 0.700 +debug: 0.650 +performance: 0.552 +vnc: 0.544 +boot: 0.465 +permissions: 0.443 +socket: 0.426 +network: 0.393 +PID: 0.358 +files: 0.280 +KVM: 0.192 +semantic: 0.981 +debug: 0.106 +files: 0.031 +other: 0.027 +PID: 0.014 +performance: 0.010 +network: 0.006 +device: 0.004 +permissions: 0.004 +boot: 0.004 +socket: 0.003 +vnc: 0.002 +graphic: 0.002 +KVM: 0.002 + +x86 SSE/SSE2/SSE3 instruction semantic bugs with NaN + +Description of problem +The result of SSE/SSE2/SSE3 instructions with NaN is different from the CPU. From Intel manual Volume 1 Appendix D.4.2.2, they defined the behavior of such instructions with NaN. But I think QEMU did not implement this semantic exactly because the byte result is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x000000007fffffff; push rax; mov rax, 0x00000000ffffffff; push rax; movdqu XMM1, [rsp];"); + asm("mov rax, 0x2e711de7aa46af1a; push rax; mov rax, 0x7fffffff7fffffff; push rax; movdqu XMM2, [rsp];"); + asm("addsubps xmm1, xmm2"); +} + +Execute and compare the result with the CPU. This problem happens with other SSE/SSE2/SSE3 instructions specified in the manual, Volume 1 Appendix D.4.2.2. + +CPU xmm1[3] = 0xffffffff + +QEMU xmm1[3] = 0x7fffffff + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/010/semantic/gitlab_semantic_adox b/results/classifier/zero-shot/010/semantic/gitlab_semantic_adox new file mode 100644 index 00000000..7919bf6c --- /dev/null +++ b/results/classifier/zero-shot/010/semantic/gitlab_semantic_adox @@ -0,0 +1,65 @@ +semantic: 0.990 +graphic: 0.782 +device: 0.776 +debug: 0.706 +vnc: 0.663 +boot: 0.599 +socket: 0.556 +permissions: 0.500 +performance: 0.460 +network: 0.426 +files: 0.374 +PID: 0.343 +other: 0.286 +KVM: 0.240 +semantic: 0.984 +debug: 0.322 +other: 0.031 +files: 0.023 +performance: 0.015 +PID: 0.007 +device: 0.005 +KVM: 0.003 +network: 0.002 +boot: 0.002 +graphic: 0.002 +permissions: 0.002 +socket: 0.002 +vnc: 0.001 + +x86 ADOX and ADCX semantic bug +Description of problem +The result of instruction ADOX and ADCX are different from the CPU. The value of one of EFLAGS is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("push 512; popfq;"); + asm("mov rax, 0xffffffff84fdbf24"); + asm("mov rbx, 0xb197d26043bec15d"); + asm("adox eax, ebx"); +} + + + +Execute and compare the result with the CPU. This problem happens with ADCX, too (with CF). + +CPU + +OF = 0 + + +QEMU + +OF = 1 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/010/semantic/gitlab_semantic_bextr b/results/classifier/zero-shot/010/semantic/gitlab_semantic_bextr new file mode 100644 index 00000000..ff13d538 --- /dev/null +++ b/results/classifier/zero-shot/010/semantic/gitlab_semantic_bextr @@ -0,0 +1,54 @@ +semantic: 0.993 +graphic: 0.790 +device: 0.717 +debug: 0.603 +boot: 0.516 +vnc: 0.471 +socket: 0.397 +PID: 0.234 +performance: 0.233 +network: 0.219 +permissions: 0.188 +other: 0.099 +files: 0.099 +KVM: 0.091 +semantic: 0.982 +debug: 0.687 +other: 0.037 +files: 0.029 +performance: 0.017 +PID: 0.008 +device: 0.007 +network: 0.006 +permissions: 0.002 +socket: 0.002 +KVM: 0.002 +graphic: 0.002 +boot: 0.002 +vnc: 0.001 + +x86 BEXTR semantic bug +Description of problem +The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x17b3693f77fb6e9"); + asm("mov rbx, 0x8f635a775ad3b9b4"); + asm("mov rcx, 0xb717b75da9983018"); + asm("bextr eax, ebx, ecx"); +} + +Execute and compare the result with the CPU. + +CPU +RAX = 0x5a + +QEMU +RAX = 0x635a775a + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/010/semantic/gitlab_semantic_blsi b/results/classifier/zero-shot/010/semantic/gitlab_semantic_blsi new file mode 100644 index 00000000..b888ffb1 --- /dev/null +++ b/results/classifier/zero-shot/010/semantic/gitlab_semantic_blsi @@ -0,0 +1,49 @@ +semantic: 0.983 +graphic: 0.873 +device: 0.790 +socket: 0.764 +vnc: 0.756 +boot: 0.678 +network: 0.672 +performance: 0.656 +files: 0.633 +permissions: 0.619 +other: 0.609 +debug: 0.525 +PID: 0.488 +KVM: 0.412 +semantic: 0.981 +debug: 0.206 +other: 0.047 +performance: 0.033 +files: 0.026 +PID: 0.009 +device: 0.006 +network: 0.004 +permissions: 0.003 +boot: 0.003 +KVM: 0.003 +graphic: 0.003 +socket: 0.002 +vnc: 0.001 + +x86 BLSI and BLSR semantic bug +Description of problem +The result of instruction BLSI and BLSR is different from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("blsi rax, rbx"); +} + + + +Execute and compare the result with the CPU. The value of CF is exactly the opposite. This problem happens with BLSR, too. + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/010/semantic/gitlab_semantic_blsmsk b/results/classifier/zero-shot/010/semantic/gitlab_semantic_blsmsk new file mode 100644 index 00000000..9995091b --- /dev/null +++ b/results/classifier/zero-shot/010/semantic/gitlab_semantic_blsmsk @@ -0,0 +1,56 @@ +semantic: 0.987 +device: 0.743 +graphic: 0.735 +vnc: 0.612 +socket: 0.607 +boot: 0.585 +debug: 0.428 +permissions: 0.370 +network: 0.366 +files: 0.340 +PID: 0.289 +other: 0.269 +performance: 0.268 +KVM: 0.163 +semantic: 0.987 +debug: 0.389 +other: 0.035 +files: 0.027 +performance: 0.021 +device: 0.009 +PID: 0.008 +KVM: 0.004 +network: 0.004 +permissions: 0.003 +socket: 0.003 +boot: 0.003 +graphic: 0.002 +vnc: 0.001 + +x86 BLSMSK semantic bug +Description of problem +The result of instruction BLSMSK is different with from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x65b2e276ad27c67"); + asm("mov rbx, 0x62f34955226b2b5d"); + asm("blsmsk eax, ebx"); +} + +Execute and compare the result with the CPU. + +CPU + +CF = 0 + + +QEMU + +CF = 1 + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/zero-shot/010/semantic/gitlab_semantic_bzhi b/results/classifier/zero-shot/010/semantic/gitlab_semantic_bzhi new file mode 100644 index 00000000..db4bd3e4 --- /dev/null +++ b/results/classifier/zero-shot/010/semantic/gitlab_semantic_bzhi @@ -0,0 +1,67 @@ +semantic: 0.920 +graphic: 0.652 +device: 0.589 +vnc: 0.287 +debug: 0.256 +boot: 0.220 +network: 0.203 +socket: 0.198 +performance: 0.165 +PID: 0.130 +permissions: 0.069 +other: 0.064 +KVM: 0.064 +files: 0.051 +semantic: 0.987 +debug: 0.282 +other: 0.033 +files: 0.022 +performance: 0.021 +PID: 0.008 +device: 0.008 +KVM: 0.004 +network: 0.004 +socket: 0.003 +permissions: 0.003 +boot: 0.003 +graphic: 0.002 +vnc: 0.001 + +x86 BZHI semantic bug +Description of problem +The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("mov rax, 0xb1aa9da2fe33fe3"); + asm("mov rbx, 0x80000000ffffffff"); + asm("mov rcx, 0xf3fce8829b99a5c6"); + asm("bzhi rax, rbx, rcx"); +} + + + +Execute and compare the result with the CPU. + +CPU + +RAX = 0x0x80000000ffffffff +SF = 1 + + +QEMU + +RAX = 0xffffffff +SF = 0 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. |