From 155eb8ba6700084a8eb36d4d3549171930f950fd Mon Sep 17 00:00:00 2001 From: Galen Williamson Date: Mon, 30 Jun 2025 15:33:57 -0400 Subject: [x86] Fixes #6628: "sysret should be considered a terminator #6628" by lifting XED_ICLASS_SYSRET* instructions as returns to RCX --- arch/x86/il.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/x86/il.cpp b/arch/x86/il.cpp index 3dd9f87a..ba36190b 100644 --- a/arch/x86/il.cpp +++ b/arch/x86/il.cpp @@ -3552,11 +3552,19 @@ bool GetLowLevelILForInstruction(Architecture* arch, const uint64_t addr, LowLev break; case XED_ICLASS_SYSEXIT: - case XED_ICLASS_SYSRET: case XED_ICLASS_HLT: il.AddInstruction(il.Trap(TRAP_GPF)); return false; + case XED_ICLASS_SYSRET: + il.AddInstruction(il.Return(il.Register(addrSize, XED_REG_ECX))); + break; + + case XED_ICLASS_SYSRET64: + case XED_ICLASS_SYSRET_AMD: + il.AddInstruction(il.Return(il.Register(addrSize, XED_REG_RCX))); + break; + case XED_ICLASS_FLD: il.AddInstruction( il.RegisterStackPush(10, -- cgit v1.3.1