Skip to content

fix: compute PF, ZF, SF after AAA and AAS instructions#2311

Open
huehuehuehueing wants to merge 1 commit intounicorn-engine:devfrom
huehuehuehueing:dev-fix_aaa-aas-flags
Open

fix: compute PF, ZF, SF after AAA and AAS instructions#2311
huehuehuehueing wants to merge 1 commit intounicorn-engine:devfrom
huehuehuehueing:dev-fix_aaa-aas-flags

Conversation

@huehuehuehueing
Copy link

Summary

  • helper_aaa and helper_aas only updated CF and AF, leaving PF, ZF, SF, and OF stale from the prior instruction
  • Real x86 CPUs consistently set PF/ZF/SF based on the masked AL result after AAA/AAS, despite Intel documenting them as "undefined"
  • The sibling helpers helper_daa/helper_das in the same file already compute these flags correctly

Fix

Compute ZF, PF, SF from result AL after AAA/AAS, using the same approach as DAA/DAS.

Test plan

  • Added test_x86_aaa_flags -- verifies PF, ZF, SF, CF after AAA with adjustment
  • Added test_x86_aas_flags -- verifies PF, ZF, SF, CF after AAS with adjustment
  • Both tests use a preceding INC to set PF to a conflicting value, confirming AAA/AAS overwrites it
  • Full x86 test suite passes (55/55)

helper_aaa and helper_aas only updated CF and AF in eflags, leaving
PF, ZF, SF, and OF stale from the prior instruction. While Intel
documents these flags as undefined after AAA/AAS, real x86 CPUs
consistently set them based on the masked AL result. The sibling
helpers helper_daa and helper_das in the same file already compute
these flags correctly.

This causes observable divergence when code branches on PF (e.g.
JP/JNP) after AAA, which occurs in real-world binaries.

The fix computes ZF, PF, SF from the result AL after AAA/AAS, using
the same approach as DAA/DAS. Two regression tests verify the correct
flag values.

Signed-off-by: Larry H <l.gr@dartmouth.edu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant