Skip to content

fix(viv): check substring in prefix for fs/gs segment access - #3218

Open
corkamig wants to merge 3 commits into
mandiant:masterfrom
corkamig:fix/viv-segment-access
Open

corkamig wants to merge 3 commits into
mandiant:masterfrom
corkamig:fix/viv-segment-access

Conversation

@corkamig

@corkamig corkamig commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Because of the way prefixes are sometimes read as exact strings or as substrings, some PEB rules are missed when a segment prefix is combined with lock or rep*.

Fixed in extract_insn_segment_access_features and added unit test test_viv_segment_access_features.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

ASM Prefixes are sometimes matched as exact string, sometimes as substring,
which leads to prefixes such as `lock fs` to be missed, notably for PEB reads.
@corkamig
corkamig force-pushed the fix/viv-segment-access branch from 8f1d4b5 to 833ca62 Compare November 3, 2026 11:20
@github-actions
github-actions Bot dismissed their stale review November 3, 2026 11:20

CHANGELOG updated or no update needed, thanks! 😄

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant