question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ud2 x86 instruction is breaking disassembly process

See original GitHub issue

Describe the bug When opening a binary on Ghidra which contains the ud2 instruction (undefined instruction), the disassembly doesn’t go further than this instruction. Ghidra just show an incomplete disassembly and the C code from the decompiler is incomplete too. However, the optcodes are good.

To Reproduce Steps to reproduce the behavior:

  1. Open a binary containing this instruction (I found the bug with the binary from this reverse challenge on HackTheBox (I solved it), the binary is attached below. (I also tested with a custom binary I created, and I encountered the same issue.)
  2. Open the function main
  3. See in the disassembly panel, on address 0x001012e6, that Ghidra didn’t disassemble further than the ud2 instruction.
  4. You can compare with the “real” assembly by using objdump -d -M intel <binary> or gdb with disassemble main (both worked for me).

Expected behavior Ghidra disassemble the binary correctly, displaying all the instructions, and the decompiler is able to read the instructions and give a complete output.

Screenshots Capture of failed disassembly by Ghidra image Capture of disassembly using objdump, showing the complete disassembly. You can see that the optcodes are good. image

Attachments The HackTheBox binary with which I first encountered the issue : binary-ud2-issue.zip

Environment (please complete the following information):

  • OS: Linux Archlinux, kernel version 5.16.16-arch1-1 x86_64
  • Java Version: 11.0.15
  • Ghidra Version: 10.1.2
  • Ghidra Origin: Archlinux AUR

Issue Analytics

  • State:closed
  • Created a year ago
  • Comments:5 (1 by maintainers)

github_iconTop GitHub Comments

1reaction
GhidorahRexcommented, May 19, 2022

Looking at the screenshot it appears you’re looking at an x86 binary, but you added the instruction to the end of the ARM64 sleigh code. You need to modify the x86 sleigh file instead. In ia.sinc, search for “:ud2” and you can probably just remove the “goto inst_start;” piece and follow the rest of the directions to get it to continue disassembling.

0reactions
mali-arfcommented, May 19, 2022

Thank you so much!!! I modified the file Ghidra/Processors/x86/data/languages/ia.sinc from :UD2 is vexMode=0 & byte=0xf; byte=0xb { invalidInstructionException(); goto inst_start; } to :UD2 is vexMode=0 & byte=0xf; byte=0xb { invalidInstructionException();}

reload ghidra and it worked!!! Thanks a lot!

Read more comments on GitHub >

github_iconTop Results From Across the Web

__ud2 | Microsoft Learn
The processor raises an invalid opcode exception if you execute an undefined instruction. The __ud2 function is equivalent to the UD2 machine ...
Read more >
UD2: Undefined Instruction (x86 Instruction Set Reference)
Description. Generates an invalid opcode. This instruction is provided for software testing to explicitly generate an invalid opcode. The opcode for this ...
Read more >
Debugging
Dump symbol address, linkage types, and names. Useful for setting break points in Bochs or Qemu. readelf, Dump ELF file metadata. objcopy, Translate...
Read more >
Undocumented OpCodes: ICEBP - Robert R. Collins
This instruction exists in this form on all 386-class processors. ICEBP - F1 - INT01 (ICE BreakPoint). An undocumented op code that will...
Read more >
notes - Apple Open Source
Disassemble x86 -64 MOV instructions which take 8, 16, ... for the 5.18 release (the cctools-580 release): - Fixed the i386 opcode for...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found