Repository navigation
docs: Control-Flow Recognition section and punpcklqdq clarification - #206
Merged
Merged
Conversation
Two doc updates following #205: ARCHITECTURE.md gains a 'Control-Flow Recognition' section covering the lift_ret REAL_return / ROP-return classification, the ret-to-IAT chain pattern (the Themida-virt mitigation that #195/#196/#205 built out), the lift_jmp direct/indirect dispatch, and the Iced operand-type quirk that motivates widening SSE accept sets. These were all undocumented and the ret-to-IAT chain in particular is a non-trivial structural rewrite that future maintainers should not have to reverse-engineer from the source. REWRITE_BASELINE.md's punpcklqdq line now reflects what actually happened: the handler had been present for a while but silently fell through to not_implemented for every site because Iced classifies the source operand by bytes-actually-accessed (low 64), not by physical XMM width. Fixed in #205 (ba20a39) by widening the accept set; pre-existing oracle vectors now pass and gate future regressions. Doc-only change. Behavior unchanged.
NaC-L
added a commit
that referenced
this pull request
Sep 22, 2026
…te (#206) Two doc updates following #205: ARCHITECTURE.md gains a 'Control-Flow Recognition' section covering the lift_ret REAL_return / ROP-return classification, the ret-to-IAT chain pattern (the Themida-virt mitigation that #195/#196/#205 built out), the lift_jmp direct/indirect dispatch, and the Iced operand-type quirk that motivates widening SSE accept sets. These were all undocumented and the ret-to-IAT chain in particular is a non-trivial structural rewrite that future maintainers should not have to reverse-engineer from the source. REWRITE_BASELINE.md's punpcklqdq line now reflects what actually happened: the handler had been present for a while but silently fell through to not_implemented for every site because Iced classifies the source operand by bytes-actually-accessed (low 64), not by physical XMM width. Fixed in #205 (fcf2702) by widening the accept set; pre-existing oracle vectors now pass and gate future regressions. Doc-only change. Behavior unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Doc-only follow-up to #205 closing two gaps that came up in the post-merge audit:
ARCHITECTURE.mdgained a Control-Flow Recognition section. Theret-to-IAT chainpattern (Themida-virt mitigation built out across lifter: recover all 4 themida-virt imports via ret-to-IAT chain #195/lifter: stop the lift loop after the ret-to-IAT chain emits its terminator #196/lifter: correctness fixes, refactors, and regression tests #205) was completely undocumented despite being a non-trivial structural rewrite. Same section also documents thelift_retreal-return vs ROP-return split,lift_jmpdirect/indirect dispatch, and the Iced operand-type quirk that motivates widening SSE accept sets. New text is descriptive of current behavior, not aspirational.docs/REWRITE_BASELINE.mdclarifies thecalc_cout/PUNPCKLQDQline. It previously said the sample was active "after SSE2 PUNPCKLQDQ support landed", but that was misleading: the handler had been present for a while and silently fell through tonot_implementedfor every site because Iced classifies the source operand by bytes-actually-accessed (low 64), not by physical XMM width. The line now describes the actual fix in lifter: correctness fixes, refactors, and regression tests #205 and references the pre-existing oracle vectors that gate future regressions.Verification
docs/-only — no build or test impact. Sanity-checked the rendered Markdown viareadto confirm structure, and grep'd for\u2014-style escape leaks (none).Why a separate PR
#205 had already merged when the user asked the doc-update question. Splitting the doc work into its own PR keeps the original PR's diff focused on code/tests and gives the doc text a clean review surface.