From b3489d7262c42a06073904fd06be298f198e4207 Mon Sep 17 00:00:00 2001 From: Ryan Houdek Date: Thu, 29 Feb 2024 02:06:57 -0800 Subject: [PATCH] ASM: Another sign extend bug in #3421 This time found in MGRR. It flips the problem space on its head. --- unittests/32Bit_ASM/FEX_bugs/SignExtendBug.asm | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/unittests/32Bit_ASM/FEX_bugs/SignExtendBug.asm b/unittests/32Bit_ASM/FEX_bugs/SignExtendBug.asm index 5337c418eb..0cc48a3a83 100644 --- a/unittests/32Bit_ASM/FEX_bugs/SignExtendBug.asm +++ b/unittests/32Bit_ASM/FEX_bugs/SignExtendBug.asm @@ -2,13 +2,16 @@ { "RegData": { "RAX": "0x41424344", - "RBX": "0x41424344" + "RBX": "0x41424344", + "RCX": "0x51525354" }, "MemoryRegions": { + "0x00fd0000": "4096", "0xf0000000": "4096" }, "MemoryData": { - "0xf0000000": "0x41424344" + "0xf0000000": "0x41424344", + "0x00fd0000": "0x51525354" }, "Mode": "32BIT" } @@ -27,4 +30,14 @@ jmp .test .test: mov ebx, [ebx+ecx] +; Ensures that zext occurs correctly with SIB indexing with second argument not having sign bit set but "index" having sign bit. +; Originally saw in Metal Gear Rising Revengeance with a `jmp dword [ecx*4+0xfdbf10]` instruction. +; With ecx = 0xfffffff4 = -12. This is them loading a switch table's branches just before the switch base. +mov ecx, -12 + +; Break the block so it can't optimize through. +jmp .test2 +.test2: + +mov ecx, [ecx*4+0x00fd_0030] hlt