AArch64: condition code NV (0b1111) is evaluated as always-false; Arm ARM ConditionHolds() returns TRUE #1575

"""a64_miasm.py <symb|python|gcc> <cases.txt>: run each one-instruction case in Miasm (aarch64l).
Case line: name hex x1 x2 nzcv(4 bits) ; prints: name asm x0 sp nzcv"""
import sys
from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB
from miasm.expression.expression import ExprInt
import miasm.arch.aarch64.regs as R
mode, path = sys.argv[1], sys.argv[2]
mach = Machine("aarch64l"); SP0 = 0x30001000; CODE = 0x10000000
def symb(code, x1, x2, f):
    from miasm.ir.symbexec import SymbolicExecutionEngine
    ldb = LocationDB(); ins = mach.mn.dis(code, "l"); ins.offset = CODE
    lifter = mach.lifter(ldb); ircfg = lifter.new_ircfg(); lifter.add_instr_to_ircfg(ins, ircfg)
    st = {R.gpregs64_expr[i]: ExprInt(0, 64) for i in range(31)}
    st[R.gpregs64_expr[1]] = ExprInt(x1, 64); st[R.gpregs64_expr[2]] = ExprInt(x2, 64)
    st[R.SP] = ExprInt(SP0, 64); st[R.XZR] = ExprInt(0, 64); st[R.WZR] = ExprInt(0, 32)
    for b, e in zip(f, (R.nf, R.zf, R.cf, R.of)): st[e] = ExprInt(int(b), 1)
    se = SymbolicExecutionEngine(lifter, st)
    se.run_block_at(ircfg, ldb.get_offset_location(CODE))
    g = lambda e: (lambda v: ("%#x" % int(v)) if v.is_int() else str(v))(se.eval_expr(e))
    return str(ins), g(R.gpregs64_expr[0]), g(R.SP), "".join(g(e)[-1] if g(e) in ("0x0", "0x1") else "?(%s)" % g(e) for e in (R.nf, R.zf, R.cf, R.of))
def jit(code, x1, x2, f):
    from miasm.jitter.csts import PAGE_READ, PAGE_WRITE, PAGE_EXEC
    j = mach.jitter(LocationDB(), mode)
    j.vm.add_memory_page(CODE, PAGE_READ | PAGE_WRITE | PAGE_EXEC, code + bytes.fromhex("000020d4"))
    j.vm.add_memory_page(SP0 - 0x1000, PAGE_READ | PAGE_WRITE, b"\x00" * 0x2000)
    j.cpu.SP = SP0; j.cpu.X1 = x1; j.cpu.X2 = x2
    j.cpu.nf, j.cpu.zf, j.cpu.cf, j.cpu.of = (int(b) for b in f)
    j.add_breakpoint(CODE + 4, lambda jit: False); j.run(CODE)
    return mach.mn.dis(code, "l"), "%#x" % j.cpu.X0, "%#x" % j.cpu.SP, "%d%d%d%d" % (j.cpu.nf, j.cpu.zf, j.cpu.cf, j.cpu.of)
for line in open(path):
    if not line.strip() or line.startswith("#"): continue
    name, hx, x1, x2, f = line.split()
    try: r = (symb if mode == "symb" else jit)(bytes.fromhex(hx), int(x1, 0), int(x2, 0), f)
    except Exception as e: r = ("-", "EXC %s: %s" % (type(e).__name__, str(e)[:120]), "-", "-")
    print("%s %s | x0=%s sp=%s nzcv=%s" % (name, r[0], r[1], r[2], r[3]))

"""a64_qemu.py <cases.txt> <workdir>: oracle. Builds a static AArch64 program per case (x1, x2, NZCV set with msr,
then the instruction word), runs it under qemu-aarch64, prints x0, sp, nzcv after the instruction."""
import subprocess, sys, struct, os
path, wd = sys.argv[1], sys.argv[2]
for line in open(path):
    if not line.strip() or line.startswith("#"): continue
    name, hx, x1, x2, f = line.split()
    word = int.from_bytes(bytes.fromhex(hx), "little")
    src = """.global _start
.text
_start:
  ldr x9, =0x30001000
  mov x13, sp
  mov sp, x9
  mov x0, #0
  ldr x1, =%s
  ldr x2, =%s
  ldr x9, =%#x
  msr nzcv, x9
  .inst %#010x
  mrs x9, nzcv
  mov x10, sp
  mov sp, x13
  adr x11, buf
  stp x0, x9, [x11]
  str x10, [x11, #16]
  mov x0, #1
  mov x1, x11
  mov x2, #24
  mov x8, #64
  svc 0
  mov x0, #0
  mov x8, #93
  svc 0
.ltorg
.data
.balign 8
buf: .skip 32
""" % (x1, x2, int(f, 2) << 28, word)
    b = os.path.join(wd, name)
    open(b + ".s", "w").write(src)
    subprocess.run(["aarch64-linux-gnu-as", "-o", b + ".o", b + ".s"], check=True)
    subprocess.run(["aarch64-linux-gnu-ld", "-static", "-o", b, b + ".o"], check=True)
    out = subprocess.run(["timeout", "10", "qemu-aarch64", b], capture_output=True).stdout
    x0, n, sp = struct.unpack("<QQQ", out)
    print("%s | x0=%#x sp=%#x nzcv=%d%d%d%d" % (name, x0, sp, (n >> 31) & 1, (n >> 30) & 1, (n >> 29) & 1, (n >> 28) & 1))