diff options
Diffstat (limited to 'results/classifier/017/semantic-x86')
6 files changed, 553 insertions, 0 deletions
diff --git a/results/classifier/017/semantic-x86/gitlab_semantic_addsubps b/results/classifier/017/semantic-x86/gitlab_semantic_addsubps new file mode 100644 index 000000000..13270d28d --- /dev/null +++ b/results/classifier/017/semantic-x86/gitlab_semantic_addsubps @@ -0,0 +1,87 @@ +x86: 0.995 +semantic: 0.974 +architecture: 0.868 +device: 0.758 +graphic: 0.700 +ppc: 0.665 +debug: 0.650 +performance: 0.552 +vnc: 0.544 +operating system: 0.543 +i386: 0.538 +assembly: 0.531 +boot: 0.465 +permissions: 0.443 +kernel: 0.427 +socket: 0.426 +network: 0.393 +PID: 0.358 +register: 0.341 +mistranslation: 0.299 +risc-v: 0.293 +files: 0.280 +TCG: 0.255 +arm: 0.252 +alpha: 0.217 +VMM: 0.216 +KVM: 0.192 +virtual: 0.176 +peripherals: 0.166 +user-level: 0.144 +hypervisor: 0.126 +-------------------- +x86: 1.000 +assembly: 0.992 +semantic: 0.981 +i386: 0.817 +debug: 0.106 +register: 0.039 +files: 0.031 +user-level: 0.025 +risc-v: 0.019 +virtual: 0.016 +PID: 0.014 +TCG: 0.013 +VMM: 0.010 +performance: 0.010 +kernel: 0.008 +architecture: 0.008 +operating system: 0.007 +alpha: 0.006 +network: 0.006 +device: 0.004 +permissions: 0.004 +boot: 0.004 +hypervisor: 0.003 +socket: 0.003 +peripherals: 0.003 +vnc: 0.002 +graphic: 0.002 +KVM: 0.002 +ppc: 0.001 +mistranslation: 0.001 +arm: 0.000 + +x86 SSE/SSE2/SSE3 instruction semantic bugs with NaN + +Description of problem +The result of SSE/SSE2/SSE3 instructions with NaN is different from the CPU. From Intel manual Volume 1 Appendix D.4.2.2, they defined the behavior of such instructions with NaN. But I think QEMU did not implement this semantic exactly because the byte result is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x000000007fffffff; push rax; mov rax, 0x00000000ffffffff; push rax; movdqu XMM1, [rsp];"); + asm("mov rax, 0x2e711de7aa46af1a; push rax; mov rax, 0x7fffffff7fffffff; push rax; movdqu XMM2, [rsp];"); + asm("addsubps xmm1, xmm2"); +} + +Execute and compare the result with the CPU. This problem happens with other SSE/SSE2/SSE3 instructions specified in the manual, Volume 1 Appendix D.4.2.2. + +CPU xmm1[3] = 0xffffffff + +QEMU xmm1[3] = 0x7fffffff + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/017/semantic-x86/gitlab_semantic_adox b/results/classifier/017/semantic-x86/gitlab_semantic_adox new file mode 100644 index 000000000..9e438c998 --- /dev/null +++ b/results/classifier/017/semantic-x86/gitlab_semantic_adox @@ -0,0 +1,100 @@ +x86: 0.996 +semantic: 0.990 +i386: 0.922 +assembly: 0.913 +architecture: 0.909 +graphic: 0.782 +device: 0.776 +debug: 0.706 +ppc: 0.677 +operating system: 0.675 +vnc: 0.663 +kernel: 0.617 +boot: 0.599 +socket: 0.556 +arm: 0.503 +risc-v: 0.501 +permissions: 0.500 +register: 0.494 +performance: 0.460 +mistranslation: 0.452 +network: 0.426 +files: 0.374 +alpha: 0.371 +PID: 0.343 +VMM: 0.283 +TCG: 0.244 +KVM: 0.240 +virtual: 0.238 +peripherals: 0.190 +hypervisor: 0.108 +user-level: 0.047 +-------------------- +x86: 1.000 +assembly: 0.986 +semantic: 0.984 +i386: 0.965 +debug: 0.322 +register: 0.126 +operating system: 0.048 +files: 0.023 +TCG: 0.018 +kernel: 0.015 +performance: 0.015 +virtual: 0.013 +user-level: 0.009 +architecture: 0.007 +PID: 0.007 +device: 0.005 +peripherals: 0.005 +hypervisor: 0.004 +VMM: 0.004 +KVM: 0.003 +network: 0.002 +boot: 0.002 +graphic: 0.002 +permissions: 0.002 +socket: 0.002 +alpha: 0.002 +risc-v: 0.002 +ppc: 0.001 +vnc: 0.001 +mistranslation: 0.000 +arm: 0.000 + +x86 ADOX and ADCX semantic bug +Description of problem +The result of instruction ADOX and ADCX are different from the CPU. The value of one of EFLAGS is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("push 512; popfq;"); + asm("mov rax, 0xffffffff84fdbf24"); + asm("mov rbx, 0xb197d26043bec15d"); + asm("adox eax, ebx"); +} + + + +Execute and compare the result with the CPU. This problem happens with ADCX, too (with CF). + +CPU + +OF = 0 + + +QEMU + +OF = 1 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/017/semantic-x86/gitlab_semantic_bextr b/results/classifier/017/semantic-x86/gitlab_semantic_bextr new file mode 100644 index 000000000..b60e81d1c --- /dev/null +++ b/results/classifier/017/semantic-x86/gitlab_semantic_bextr @@ -0,0 +1,89 @@ +x86: 0.997 +semantic: 0.993 +architecture: 0.859 +register: 0.846 +assembly: 0.800 +graphic: 0.790 +device: 0.717 +operating system: 0.620 +debug: 0.603 +ppc: 0.525 +boot: 0.516 +kernel: 0.479 +vnc: 0.471 +socket: 0.397 +risc-v: 0.396 +i386: 0.361 +mistranslation: 0.337 +arm: 0.336 +PID: 0.234 +performance: 0.233 +network: 0.219 +permissions: 0.188 +alpha: 0.150 +TCG: 0.109 +VMM: 0.102 +virtual: 0.101 +files: 0.099 +peripherals: 0.099 +KVM: 0.091 +hypervisor: 0.024 +user-level: 0.015 +-------------------- +x86: 1.000 +assembly: 0.991 +semantic: 0.982 +i386: 0.980 +debug: 0.687 +register: 0.219 +user-level: 0.151 +operating system: 0.067 +virtual: 0.044 +files: 0.029 +kernel: 0.023 +hypervisor: 0.017 +performance: 0.017 +TCG: 0.016 +architecture: 0.009 +PID: 0.008 +peripherals: 0.007 +device: 0.007 +network: 0.006 +alpha: 0.003 +risc-v: 0.003 +VMM: 0.003 +permissions: 0.002 +socket: 0.002 +KVM: 0.002 +graphic: 0.002 +boot: 0.002 +ppc: 0.001 +vnc: 0.001 +mistranslation: 0.001 +arm: 0.000 + +x86 BEXTR semantic bug +Description of problem +The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x17b3693f77fb6e9"); + asm("mov rbx, 0x8f635a775ad3b9b4"); + asm("mov rcx, 0xb717b75da9983018"); + asm("bextr eax, ebx, ecx"); +} + +Execute and compare the result with the CPU. + +CPU +RAX = 0x5a + +QEMU +RAX = 0x635a775a + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/017/semantic-x86/gitlab_semantic_blsi b/results/classifier/017/semantic-x86/gitlab_semantic_blsi new file mode 100644 index 000000000..33fb5b305 --- /dev/null +++ b/results/classifier/017/semantic-x86/gitlab_semantic_blsi @@ -0,0 +1,84 @@ +x86: 0.997 +semantic: 0.983 +architecture: 0.887 +graphic: 0.873 +assembly: 0.852 +i386: 0.827 +device: 0.790 +kernel: 0.770 +socket: 0.764 +vnc: 0.756 +operating system: 0.725 +ppc: 0.719 +arm: 0.685 +boot: 0.678 +network: 0.672 +performance: 0.656 +risc-v: 0.651 +files: 0.633 +permissions: 0.619 +mistranslation: 0.606 +TCG: 0.538 +debug: 0.525 +PID: 0.488 +register: 0.488 +alpha: 0.475 +VMM: 0.449 +KVM: 0.412 +virtual: 0.342 +peripherals: 0.335 +hypervisor: 0.238 +user-level: 0.138 +-------------------- +x86: 1.000 +assembly: 0.985 +semantic: 0.981 +i386: 0.962 +debug: 0.206 +register: 0.172 +operating system: 0.060 +performance: 0.033 +kernel: 0.027 +files: 0.026 +TCG: 0.018 +architecture: 0.012 +virtual: 0.011 +user-level: 0.010 +PID: 0.009 +peripherals: 0.007 +device: 0.006 +risc-v: 0.005 +VMM: 0.005 +alpha: 0.005 +hypervisor: 0.004 +network: 0.004 +permissions: 0.003 +boot: 0.003 +KVM: 0.003 +graphic: 0.003 +socket: 0.002 +vnc: 0.001 +mistranslation: 0.001 +ppc: 0.000 +arm: 0.000 + +x86 BLSI and BLSR semantic bug +Description of problem +The result of instruction BLSI and BLSR is different from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("blsi rax, rbx"); +} + + + +Execute and compare the result with the CPU. The value of CF is exactly the opposite. This problem happens with BLSR, too. + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/017/semantic-x86/gitlab_semantic_blsmsk b/results/classifier/017/semantic-x86/gitlab_semantic_blsmsk new file mode 100644 index 000000000..1352cdaa3 --- /dev/null +++ b/results/classifier/017/semantic-x86/gitlab_semantic_blsmsk @@ -0,0 +1,91 @@ +x86: 0.997 +semantic: 0.987 +architecture: 0.935 +assembly: 0.879 +i386: 0.871 +device: 0.743 +graphic: 0.735 +ppc: 0.729 +operating system: 0.627 +vnc: 0.612 +socket: 0.607 +mistranslation: 0.603 +boot: 0.585 +register: 0.568 +alpha: 0.543 +kernel: 0.521 +arm: 0.512 +risc-v: 0.501 +debug: 0.428 +permissions: 0.370 +network: 0.366 +files: 0.340 +PID: 0.289 +performance: 0.268 +TCG: 0.254 +VMM: 0.231 +virtual: 0.185 +KVM: 0.163 +peripherals: 0.134 +hypervisor: 0.067 +user-level: 0.028 +-------------------- +x86: 1.000 +semantic: 0.987 +assembly: 0.982 +i386: 0.968 +debug: 0.389 +register: 0.292 +operating system: 0.057 +kernel: 0.047 +files: 0.027 +performance: 0.021 +virtual: 0.019 +TCG: 0.016 +peripherals: 0.011 +user-level: 0.011 +device: 0.009 +PID: 0.008 +architecture: 0.008 +hypervisor: 0.006 +VMM: 0.005 +KVM: 0.004 +network: 0.004 +permissions: 0.003 +socket: 0.003 +boot: 0.003 +graphic: 0.002 +risc-v: 0.002 +alpha: 0.002 +vnc: 0.001 +mistranslation: 0.001 +ppc: 0.000 +arm: 0.000 + +x86 BLSMSK semantic bug +Description of problem +The result of instruction BLSMSK is different with from the CPU. The value of CF is different. + +Steps to reproduce + +Compile this code + +void main() { + asm("mov rax, 0x65b2e276ad27c67"); + asm("mov rbx, 0x62f34955226b2b5d"); + asm("blsmsk eax, ebx"); +} + +Execute and compare the result with the CPU. + +CPU + +CF = 0 + + +QEMU + +CF = 1 + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. diff --git a/results/classifier/017/semantic-x86/gitlab_semantic_bzhi b/results/classifier/017/semantic-x86/gitlab_semantic_bzhi new file mode 100644 index 000000000..d32cca9bd --- /dev/null +++ b/results/classifier/017/semantic-x86/gitlab_semantic_bzhi @@ -0,0 +1,102 @@ +x86: 0.983 +semantic: 0.920 +graphic: 0.652 +device: 0.589 +architecture: 0.518 +register: 0.406 +assembly: 0.406 +arm: 0.318 +ppc: 0.310 +kernel: 0.308 +vnc: 0.287 +debug: 0.256 +operating system: 0.234 +boot: 0.220 +risc-v: 0.211 +network: 0.203 +socket: 0.198 +mistranslation: 0.171 +performance: 0.165 +PID: 0.130 +peripherals: 0.094 +i386: 0.091 +alpha: 0.089 +permissions: 0.069 +KVM: 0.064 +VMM: 0.056 +TCG: 0.053 +files: 0.051 +virtual: 0.048 +hypervisor: 0.031 +user-level: 0.025 +-------------------- +x86: 1.000 +i386: 0.989 +assembly: 0.989 +semantic: 0.987 +debug: 0.282 +register: 0.159 +operating system: 0.067 +kernel: 0.025 +files: 0.022 +TCG: 0.021 +performance: 0.021 +virtual: 0.020 +user-level: 0.013 +hypervisor: 0.010 +architecture: 0.009 +PID: 0.008 +device: 0.008 +peripherals: 0.007 +KVM: 0.004 +network: 0.004 +VMM: 0.003 +risc-v: 0.003 +socket: 0.003 +permissions: 0.003 +boot: 0.003 +alpha: 0.002 +graphic: 0.002 +vnc: 0.001 +ppc: 0.001 +mistranslation: 0.001 +arm: 0.000 + +x86 BZHI semantic bug +Description of problem +The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different. + +Steps to reproduce + +Compile this code + + +void main() { + asm("mov rax, 0xb1aa9da2fe33fe3"); + asm("mov rbx, 0x80000000ffffffff"); + asm("mov rcx, 0xf3fce8829b99a5c6"); + asm("bzhi rax, rbx, rcx"); +} + + + +Execute and compare the result with the CPU. + +CPU + +RAX = 0x0x80000000ffffffff +SF = 1 + + +QEMU + +RAX = 0xffffffff +SF = 0 + + + + + + +Additional information +This bug is discovered by research conducted by KAIST SoftSec. |