mishegos

Differential fuzzing is woefully underutilized -- our experience is that it consistently[1] finds[2] bugs that "traditional" fuzzing techniques struggle to discover, and that the primary obstacles to its adoption are harness and orchestration complexity. DIFFER goes a long way towards overcoming those obstacles! (FD: My company.) [1]: https://github.com/trailofbits/mishegos [2]: https://x509-limbo.com/

I remember seeing a copy of this Usenet post years ago! It's one of my favorite "secrets" about x86's encoding. The "core" (non-E/VEX, non-SSE, etc.) x86 encoding is wonderfully clever and terrible by modern standards, and Volume 2 of Intel's SDM is a great reference for how x86 manages to pack remarkably complicated addressing, operand, etc. semantics into just a handful of bytes. The result is a format that's remarkably hard to decode correctly, meaning that just about every software decoder for x86 is saturated with bugs[1] (FD: my project). [1]: https://github.com/trailofbits/mishegos

This is a really clever technique! I was impressed by sandsifter[1] when it originally came out, and this seems an awful lot faster and less prone to false negatives (since it's purely speculative and doesn't require sandsifter's `#PF` hack). At the risk of unwarranted self-promotion: the other side of this equation is fidelity in software instruction set decoders. x86's massive size and layers of historical complexity make it among the most difficult instruction formats to accurately decode; I've spent a good part of the last two years working on a fuzzer that's discovered thousands of bugs in various popular x86 decoders[2][3]. [1]: https://github.com/xoreaxeaxeax/sandsifter [2]: https://github.com/trailofbits/mishegos [3]: https://ww.easychair.org/publications/preprint_download/1LHr

It sounds like what you want is Mishegos [1], described here [2]. In fact, this work shows that Capstone performs rather poorly compared to more permissively licensed open-source competitors such as Intel XED and Zydis. Really, if your focus is x86, then Capstone is not the right choice. If you need cross-architecture support, then perhaps Capstone is the right choice. [1] https://github.com/trailofbits/mishegos [2] https://blog.trailofbits.com/2019/10/31/destroying-x86_64-in...

Bddisasm is a nice piece of work! The last few years have seen a real explosion in the number and quality of open source x86 decoders. The Bitdefender team states in their README that they've been using my differential fuzzer[1] to test bddisasm's resiliency[2]. I have no reason to doubt them, but it would certainly be interesting to see the results of a few hours of fuzzing against some near-or-equally high quality decoders (i.e. Zydis and XED). [1]: https://github.com/trailofbits/mishegos [2]: https://github.com/bitdefender/bddisasm#objectives