sha0coder/scemu

rdtsc (read timestamp counter) broken

Closed this issue · 4 comments

{
    "i": 53,
    "x64dbgLine": {
      "rawLine": {
        "Index": "00035",
        "Address": "0000000144FF95A0",
        "Bytes": "0F31",
        "Disassembly": "rdtsc ",
        "Registers": "rax: 100000FDFF-> E6668424 rdx: 0-> 1BC2B",
        "Memory": "",
        "Comments": ""
      },
      "rip": "144ff95a0",
      "registerChanges": [
        {
          "registerName": "rax",
          "previousValue": "100000fdff",
          "newValue": "e6668424"
        },
        {
          "registerName": "rdx",
          "previousValue": "0",
          "newValue": "1bc2b"
        }
      ],
      "memoryChanges": []
    },
    "scemuLine": {
      "rawLine": "diff_reg: rip = 144ff95a0 rax 100000fdff -> 0;",
      "rip": "144ff95a0",
      "registerChanges": [
        {
          "registerName": "rax",
          "previousValue": "100000fdff",
          "newValue": "0"
        }
      ],
      "memoryChanges": []
    },
    "instructionErrors": [
      {
        "index": 0,
        "message": "newValue mismatch",
        "x64dbg": "e6668424",
        "scemu": "0"
      },
      {
        "index": 1,
        "message": "unmatchedRegisterChange mismatch (x64dbg but not scemu)",
        "x64dbg": "rdx"
      }
    ]
  },
 Mnemonic::Rdtsc => {
                self.show_instruction(&self.colors.red, &ins);
                // TODO: actually mock a timestamp?
                self.regs.rdx = 0x1BC2B;
                self.regs.rax = 0xE6668424;
            }

this will work for DTS9_PatcherV but the next instruction flags are off

do we need to do set_operand_value instead of setting self.regs directly because otherwise flags will not update?

set_operand_value don't update flags, because its also used by instructions that don't update flags.
rdtsc is used for malwares as an anti-analisis, reads TSC which is the bus cycle, it would be nice figure out how to emulate it.
measuring the cpu cicles of every instruction is huge work.
bus cycle is updated every n x cpu cycle.

we're just going to mock it for now/hardcode it