metasm 1.0.0 → 1.0.5

data/{lib/metasm → metasm/cpu}/ia32/decompile.rb

@@ -4,17 +4,26 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/main'
+require 'metasm/cpu/ia32/main'
 
 module Metasm
 class Ia32
 	# temporarily setup dasm.address_binding so that backtracking
 	# stack-related offsets resolve in :frameptr (relative to func start)
 	def decompile_makestackvars(dasm, funcstart, blocks)
+		esp = register_symbols[4]
 		oldfuncbd = dasm.address_binding[funcstart]
-		dasm.address_binding[funcstart] = { :esp => :frameptr }	# this would suffice, the rest here is just optimisation
-
+		dasm.address_binding[funcstart] = { esp => :frameptr }
 		patched_binding = [funcstart]	# list of addresses to cleanup later
+
+		if blocks.length <= 12
+			blocks.each { |block| yield block }
+			return
+		end
+
+		# for large function, pre-trace and cache esp/ebp for every block start to improve decompilation time
+
+		ebp = register_symbols[5]
 		ebp_frame = true
 
 		# pretrace esp and ebp for each function block (cleared later)
@@ -24,16 +33,16 @@ class Ia32
 			if not dasm.address_binding[blockstart]
 				patched_binding << blockstart
 				dasm.address_binding[blockstart] = {}
-				foo = dasm.backtrace(:esp, blockstart, :snapshot_addr => funcstart)
+				foo = dasm.backtrace(esp, blockstart, :snapshot_addr => funcstart)
 				if foo.length == 1 and ee = foo.first and ee.kind_of? Expression and (ee == Expression[:frameptr] or
 						(ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer))
-					dasm.address_binding[blockstart][:esp] = ee
+					dasm.address_binding[blockstart][esp] = ee
 				end
 				if ebp_frame
-					foo = dasm.backtrace(:ebp, blockstart, :snapshot_addr => funcstart)
+					foo = dasm.backtrace(ebp, blockstart, :snapshot_addr => funcstart)
 					if foo.length == 1 and ee = foo.first and ee.kind_of? Expression and (ee == Expression[:frameptr] or
 							(ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer))
-						dasm.address_binding[blockstart][:ebp] = ee
+						dasm.address_binding[blockstart][ebp] = ee
 					else
 						ebp_frame = false	# func does not use ebp as frame ptr, no need to bt for later blocks
 					end
@@ -48,11 +57,16 @@ class Ia32
 		dasm.address_binding[funcstart] = oldfuncbd if oldfuncbd
 	end
 
+	# add di-specific registry written/accessed
+	def decompile_func_finddeps_di(dcmp, func, di, a, w)
+		a << register_symbols[0] if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void)	# standard ABI
+	end
+
 	# list variable dependency for each block, remove useless writes
 	# returns { blockaddr => [list of vars that are needed by a following block] }
 	def decompile_func_finddeps(dcmp, blocks, func)
 		deps_r = {} ; deps_w = {} ; deps_to = {}
-		deps_subfunc = {} 	# things read/written by subfuncs
+		deps_subfunc = {}	# things read/written by subfuncs
 
 		# find read/writes by each block
 		blocks.each { |b, to|
@@ -69,8 +83,8 @@ class Ia32
 					else a |= Expression[k].externals	# if dword [eax] <- 42, eax is read
 					end
 				}
-				a << :eax if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void)	# standard ABI
-				
+				decompile_func_finddeps_di(dcmp, func, di, a, w)
+
 				deps_r[b] |= a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - deps_w[b]
 				deps_w[b] |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown]
 			}
@@ -97,7 +111,7 @@ class Ia32
 			}
 			if stackoff	# last block instr == subfunction call
 				deps_r[b] |= deps_subfunc[b] - deps_w[b]
-				deps_w[b] |= [:eax, :ecx, :edx]			# standard ABI
+				deps_w[b] |= register_symbols[0, 3]			# standard ABI
 			end
 		}
 
@@ -120,13 +134,13 @@ class Ia32
 						else a |= Expression[k].externals	# if dword [eax] <- 42, eax is read
 						end
 					}
-					a << :eax if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void)	# standard ABI
-					
+					decompile_func_finddeps_di(dcmp, func, di, a, w)
+
 					next true if (a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - bw).include? r
 					bw |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown]
 					false
 				}
-				if r == :eax and (rdi || blk.list.last).opcode.name == 'ret'
+				if r == register_symbols[0] and (rdi || blk.list.last).opcode.name == 'ret'
 					func.type.type = C::BaseType.new(:void)
 					false
 				elsif rdi and rdi.backtrace_binding[r]
@@ -180,15 +194,18 @@ class Ia32
 	end
 
 	def decompile_blocks(dcmp, myblocks, deps, func, nextaddr = nil)
+		eax, ecx, edx, ebx, esp, ebp, esi, edi = register_symbols
+		ebx, esp, ebp = ebx, esp, ebp	# fix ruby unused var warning
 		scope = func.initializer
 		func.type.args.each { |a| scope.symbol[a.name] = a }
 		stmts = scope.statements
 		blocks_toclean = myblocks.dup
 		func_entry = myblocks.first[0]
+		di_addr = nil
 		until myblocks.empty?
 			b, to = myblocks.shift
 			if l = dcmp.dasm.get_label_at(b)
-				stmts << C::Label.new(l)
+				stmts << C::Label.new(l).with_misc(:di_addr => b)
 			end
 
 			# list of assignments [[dest reg, expr assigned]]
@@ -196,7 +213,11 @@ class Ia32
 			# reg binding (reg => value, values.externals = regs at block start)
 			binding = {}
 			# Expr => CExpr
-			ce  = lambda { |*e| dcmp.decompile_cexpr(Expression[Expression[*e].reduce], scope) }
+			ce  = lambda { |*e|
+				ret = dcmp.decompile_cexpr(Expression[Expression[*e].reduce], scope)
+				dcmp.walk_ce(ret) { |ee| ee.with_misc(:di_addr => di_addr) } if di_addr
+				ret
+			}
 			# Expr => Expr.bind(binding) => CExpr
 			ceb = lambda { |*e| ce[Expression[*e].bind(binding)] }
 
@@ -221,6 +242,7 @@ class Ia32
 			# returns an array to use as funcall arguments
 			get_func_args = lambda { |di, f|
 				# XXX see remarks in #finddeps
+				# TODO x64
 				bt = dcmp.dasm.backtrace(:esp, di.address, :snapshot_addr => func_entry, :include_start => true)
 				stackoff = Expression[[bt, :+, @size/8], :-, :esp].bind(:esp => :frameptr).reduce rescue nil
 				args_todo = f.type.args.to_a.dup
@@ -269,19 +291,20 @@ class Ia32
 
 			# go !
 			dcmp.dasm.decoded[b].block.list.each_with_index { |di, didx|
+				di_addr = di.address
 				a = di.instruction.args
 				if di.opcode.props[:setip] and not di.opcode.props[:stopexec]
 					# conditional jump
 					commit[]
 					n = dcmp.backtrace_target(get_xrefs_x(dcmp.dasm, di).first, di.address)
 					if di.opcode.name =~ /^loop(.+)?/
-						cx = C::CExpression[:'--', ceb[:ecx]]
+						cx = C::CExpression[:'--', ceb[ecx]]
 						cc = $1 ? C::CExpression[cx, :'&&', ceb[decode_cc_to_expr($1)]] : cx
 					else
 						cc = ceb[decode_cc_to_expr(di.opcode.name[1..-1])]
 					end
 					# XXX switch/indirect/multiple jmp
-					stmts << C::If.new(C::CExpression[cc], C::Goto.new(n))
+					stmts << C::If.new(C::CExpression[cc], C::Goto.new(n).with_misc(:di_addr => di_addr)).with_misc(:di_addr => di_addr)
 					to.delete dcmp.dasm.normalize(n)
 					next
 				end
@@ -290,7 +313,7 @@ class Ia32
 					# mov cr0 etc
 					a1, a2 = di.instruction.args
 					case a1
-					when Ia32::CtrlReg, Ia32::DbgReg, Ia32::SegReg
+					when Ia32::CtrlReg, Ia32::DbgReg, Ia32::TstReg, Ia32::SegReg
 						sz = a1.kind_of?(Ia32::SegReg) ? 16 : 32
 						if not dcmp.c_parser.toplevel.symbol["intrinsic_set_#{a1}"]
 							dcmp.c_parser.parse("void intrinsic_set_#{a1}(__int#{sz});")
@@ -298,11 +321,11 @@ class Ia32
 						f = dcmp.c_parser.toplevel.symbol["intrinsic_set_#{a1}"]
 						a2 = a2.symbolic(di)
 						a2 = [a2, :&, 0xffff] if sz == 16
-						stmts << C::CExpression.new(f, :funcall, [ceb[a2]], f.type.type)
+						stmts << C::CExpression.new(f, :funcall, [ceb[a2]], f.type.type).with_misc(:di_addr => di_addr)
 						next
 					end
 					case a2
-					when Ia32::CtrlReg, Ia32::DbgReg, Ia32::SegReg
+					when Ia32::CtrlReg, Ia32::DbgReg, Ia32::TstReg, Ia32::SegReg
 						if not dcmp.c_parser.toplevel.symbol["intrinsic_get_#{a2}"]
 							sz = a2.kind_of?(Ia32::SegReg) ? 16 : 32
 							dcmp.c_parser.parse("__int#{sz} intrinsic_get_#{a2}(void);")
@@ -310,7 +333,7 @@ class Ia32
 						f = dcmp.c_parser.toplevel.symbol["intrinsic_get_#{a2}"]
 						t = f.type.type
 						binding.delete a1.symbolic(di)
-						stmts << C::CExpression.new(ce[a1.symbolic(di)], :'=', C::CExpression.new(f, :funcall, [], t), t)
+						stmts << C::CExpression.new(ce[a1.symbolic(di)], :'=', C::CExpression.new(f, :funcall, [], t).with_misc(:di_addr => di_addr), t).with_misc(:di_addr => di_addr)
 						next
 					end
 				end
@@ -319,8 +342,8 @@ class Ia32
 				when 'ret'
 					commit[]
 					ret = nil
-					ret = C::CExpression[ceb[:eax]] unless func.type.type.kind_of? C::BaseType and func.type.type.name == :void
-					stmts << C::Return.new(ret)
+					ret = C::CExpression[ceb[eax]] unless func.type.type.kind_of? C::BaseType and func.type.type.name == :void
+					stmts << C::Return.new(ret).with_misc(:di_addr => di_addr)
 				when 'call'	# :saveip
 					n = dcmp.backtrace_target(get_xrefs_x(dcmp.dasm, di).first, di.address)
 					args = []
@@ -353,9 +376,9 @@ class Ia32
 						end
 					end
 					commit[]
-					binding.delete :eax
-					e = C::CExpression[f, :funcall, args]
-					e = C::CExpression[ce[:eax], :'=', e, f.type.type] if deps[b].include? :eax and f.type.type != C::BaseType.new(:void)
+					binding.delete eax
+					e = C::CExpression[f, :funcall, args].with_misc(:di_addr => di_addr)
+					e = C::CExpression[ce[eax], :'=', e, f.type.type].with_misc(:di_addr => di_addr) if deps[b].include? eax and f.type.type != C::BaseType.new(:void)
 					stmts << e
 				when 'jmp'
 					#if di.comment.to_a.include? 'switch'
@@ -369,12 +392,12 @@ class Ia32
 					#		to.delete addr
 					#		next if not l = dcmp.dasm.get_label_at(addr)
 					#		sw.body.statements << C::Goto.new(l)
- 					#	}
+					#	}
 					#	stmts << sw
 					a = di.instruction.args.first
 					if a.kind_of? Expression
 					elsif not a.respond_to? :symbolic
-						stmts << C::Asm.new(di.instruction.to_s, nil, [], [], nil, nil)
+						stmts << C::Asm.new(di.instruction.to_s, nil, [], [], nil, nil).with_misc(:di_addr => di_addr)
 					else
 						n = di.instruction.args.first.symbolic(di)
 						fptr = ceb[n]
@@ -385,12 +408,10 @@ class Ia32
 							args = get_func_args[di, fptr.type]
 						else
 							proto = C::Function.new(C::BaseType.new(:void))
-							fptr = C::CExpression[[fptr], C::Pointer.new(proto)]
+							fptr = C::CExpression[[fptr], C::Pointer.new(proto)].with_misc(:di_addr => di_addr)
 							args = []
 						end
-						ret = C::Return.new(C::CExpression[fptr, :funcall, args])
-						class << ret ; attr_accessor :from_instr end
-						ret.from_instr = di
+						ret = C::Return.new(C::CExpression[fptr, :funcall, args].with_misc(:di_addr => di_addr)).with_misc(:di_addr => di_addr)
 						stmts << ret
 						to = []
 					end
@@ -404,7 +425,7 @@ class Ia32
 					end
 					# need a way to transform arg => :frameptr+12
 					arg = di.backtrace_binding.keys.grep(Indirection).first.pointer
-					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol['intrinsic_lgdt'], :funcall, [ceb[arg]], C::BaseType.new(:void))
+					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol['intrinsic_lgdt'], :funcall, [ceb[arg]], C::BaseType.new(:void)).with_misc(:di_addr => di_addr)
 				when 'lidt'
 					if not dcmp.c_parser.toplevel.struct['interrupt_descriptor']
 						dcmp.c_parser.parse('struct interrupt_descriptor { __int16 offset0_16; __int16 segment; __int16 flags; __int16 offset16_32; };')
@@ -414,29 +435,29 @@ class Ia32
 						dcmp.c_parser.parse('void intrinsic_lidt(struct interrupt_table *);')
 					end
 					arg = di.backtrace_binding.keys.grep(Indirection).first.pointer
-					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol['intrinsic_lidt'], :funcall, [ceb[arg]], C::BaseType.new(:void))
+					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol['intrinsic_lidt'], :funcall, [ceb[arg]], C::BaseType.new(:void)).with_misc(:di_addr => di_addr)
 				when 'ltr', 'lldt'
 					if not dcmp.c_parser.toplevel.symbol["intrinsic_#{di.opcode.name}"]
 						dcmp.c_parser.parse("void intrinsic_#{di.opcode.name}(int);")
 					end
 					arg = di.backtrace_binding.keys.first
-					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol["intrinsic_#{di.opcode.name}"], :funcall, [ceb[arg]], C::BaseType.new(:void))
+					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol["intrinsic_#{di.opcode.name}"], :funcall, [ceb[arg]], C::BaseType.new(:void)).with_misc(:di_addr => di_addr)
 				when 'out'
 					sz = di.instruction.args.find { |a_| a_.kind_of? Ia32::Reg and a_.val == 0 }.sz
 					if not dcmp.c_parser.toplevel.symbol["intrinsic_out#{sz}"]
 						dcmp.c_parser.parse("void intrinsic_out#{sz}(unsigned short port, __int#{sz} value);")
 					end
-					port = di.instruction.args.grep(Expression).first || :edx
-					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol["intrinsic_out#{sz}"], :funcall, [ceb[port], ceb[:eax]], C::BaseType.new(:void))
+					port = di.instruction.args.grep(Expression).first || edx
+					stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol["intrinsic_out#{sz}"], :funcall, [ceb[port], ceb[eax]], C::BaseType.new(:void)).with_misc(:di_addr => di_addr)
 				when 'in'
 					sz = di.instruction.args.find { |a_| a_.kind_of? Ia32::Reg and a_.val == 0 }.sz
 					if not dcmp.c_parser.toplevel.symbol["intrinsic_in#{sz}"]
 						dcmp.c_parser.parse("__int#{sz} intrinsic_in#{sz}(unsigned short port);")
 					end
-					port = di.instruction.args.grep(Expression).first || :edx
+					port = di.instruction.args.grep(Expression).first || edx
 					f = dcmp.c_parser.toplevel.symbol["intrinsic_in#{sz}"]
-					binding.delete :eax
-					stmts << C::CExpression.new(ce[:eax], :'=', C::CExpression.new(f, :funcall, [ceb[port]], f.type.type), f.type.type)
+					binding.delete eax
+					stmts << C::CExpression.new(ce[eax], :'=', C::CExpression.new(f, :funcall, [ceb[port]], f.type.type), f.type.type).with_misc(:di_addr => di_addr)
 				when 'sti', 'cli'
 					stmts << C::Asm.new(di.instruction.to_s, nil, [], [], nil, nil)
 				when /^(mov|sto|lod)s([bwdq])/
@@ -448,15 +469,15 @@ class Ia32
 					blk = C::Block.new(scope)
 					case op
 					when 'mov'
-						blk.statements << C::CExpression[[:*, [[ceb[:edi]], pt]], :'=', [:*, [[ceb[:esi]], pt]]]
-						blk.statements << C::CExpression[ceb[:edi], :'=', [ceb[:edi], :+, [sz]]]
-						blk.statements << C::CExpression[ceb[:esi], :'=', [ceb[:esi], :+, [sz]]]
+						blk.statements << C::CExpression[[:*, [[ceb[edi]], pt]], :'=', [:*, [[ceb[esi]], pt]]].with_misc(:di_addr => di_addr)
+						blk.statements << C::CExpression[ceb[edi], :'=', [ceb[edi], :+, [sz]]].with_misc(:di_addr => di_addr)
+						blk.statements << C::CExpression[ceb[esi], :'=', [ceb[esi], :+, [sz]]].with_misc(:di_addr => di_addr)
 					when 'sto'
-						blk.statements << C::CExpression[[:*, [[ceb[:edi]], pt]], :'=', ceb[:eax]]
-						blk.statements << C::CExpression[ceb[:edi], :'=', [ceb[:edi], :+, [sz]]]
+						blk.statements << C::CExpression[[:*, [[ceb[edi]], pt]], :'=', ceb[eax]].with_misc(:di_addr => di_addr)
+						blk.statements << C::CExpression[ceb[edi], :'=', [ceb[edi], :+, [sz]]].with_misc(:di_addr => di_addr)
 					when 'lod'
-						blk.statements << C::CExpression[ceb[:eax], :'=', [:*, [[ceb[:esi]], pt]]]
-						blk.statements << C::CExpression[ceb[:esi], :'=', [ceb[:esi], :+, [sz]]]
+						blk.statements << C::CExpression[ceb[eax], :'=', [:*, [[ceb[esi]], pt]]].with_misc(:di_addr => di_addr)
+						blk.statements << C::CExpression[ceb[esi], :'=', [ceb[esi], :+, [sz]]].with_misc(:di_addr => di_addr)
 					#when 'sca'
 					#when 'cmp'
 					end
@@ -465,8 +486,8 @@ class Ia32
 					when nil
 						stmts.concat blk.statements
 					when 'rep'
-						blk.statements << C::CExpression[ceb[:ecx], :'=', [ceb[:ecx], :-, [1]]]
-						stmts << C::While.new(C::CExpression[ceb[:ecx]], blk)
+						blk.statements << C::CExpression[ceb[ecx], :'=', [ceb[ecx], :-, [1]]].with_misc(:di_addr => di_addr)
+						stmts << C::While.new(C::CExpression[ceb[ecx]], blk).with_misc(:di_addr => di_addr)
 					#when 'repz'	# sca/cmp only
 					#when 'repnz'
 					end
@@ -475,7 +496,7 @@ class Ia32
 					bd = get_fwdemu_binding(di)
 					if di.backtrace_binding[:incomplete_binding]
 						commit[]
-						stmts << C::Asm.new(di.instruction.to_s, nil, nil, nil, nil, nil)
+						stmts << C::Asm.new(di.instruction.to_s, nil, nil, nil, nil, nil).with_misc(:di_addr => di_addr)
 					else
 						update = {}
 						bd.each { |k, v|
@@ -490,6 +511,7 @@ class Ia32
 						binding.update update
 					end
 				end
+				di_addr = nil
 			}
 			commit[]
 
@@ -512,9 +534,9 @@ class Ia32
 			dcmp.dasm.decoded[b_].block.list.each { |di|
 				di.backtrace_binding = nil
 			}
-	       	}
+		}
 	end
-	
+
 	def decompile_check_abi(dcmp, entry, func)
 		a = func.type.args || []
 		a.delete_if { |arg| arg.has_attribute_var('register') and arg.has_attribute('unused') }

data/{lib/metasm → metasm/cpu}/ia32/encode.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 require 'metasm/encode'
 
 module Metasm
@@ -195,27 +195,28 @@ class Ia32
 			case k
 			when :jmp;  {:jmp => 0x3e, :nojmp => 0x2e}[v]
 			when :lock; 0xf0
-			when :rep;  {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v] # TODO
+			when :rep;  {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v]
+			when :jmphint; {'hintjmp' => 0x3e, 'hintnojmp' => 0x2e}[v]
+			when :seg; [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][v.val]
 			end
 		}.compact.pack 'C*'
-		pfx << op.props[:needpfx] if op.props[:needpfx]
 
 		if op.name == 'movsx' or op.name == 'movzx'
 			pfx << 0x66 if size == 48-i.args[0].sz
+		elsif op.name == 'crc32'
+			pfx << 0x66 if size == 48-i.args[1].sz
 		else
 			opsz = op.props[:argsz]
 			oi.each { |oa, ia|
 				case oa
-				when :reg, :reg_eax, :modrm, :modrmA, :mrm_imm
+				when :reg, :reg_eax, :modrm, :mrm_imm
 					raise EncodeError, "Incompatible arg size in #{i}" if ia.sz and opsz and opsz != ia.sz
 					opsz = ia.sz
 				end
 			}
-			pfx << 0x66 if (not op.props[:argsz] or opsz != op.props[:argsz]) and (
-				(opsz and size == 48 - opsz) or (op.props[:opsz] and op.props[:opsz] != size))
-			if op.props[:opsz] and size == 48 - op.props[:opsz]
-				opsz = op.props[:opsz]
-			end
+			pfx << 0x66 if (op.props[:opsz] and size == 48 - op.props[:opsz]) or
+					(not op.props[:argsz] and opsz and size == 48 - opsz)
+			opsz ||= op.props[:opsz]
 		end
 		opsz ||= size
 
@@ -226,7 +227,7 @@ class Ia32
 		adsz ||= size
 		# addrsize override / segment override
 		if mrm = i.args.grep(ModRM).first
-			if not op.props[:adsz] and ((mrm.b and mrm.b.sz != adsz) or (mrm.i and mrm.i.sz != adsz))
+			if not op.props[:adsz] and ((mrm.b and mrm.b.sz == 48 - adsz) or (mrm.i and mrm.i.sz == 48 - adsz))
 				pfx << 0x67
 				adsz = 48 - adsz
 			end
@@ -240,10 +241,12 @@ class Ia32
 		postponed = []
 		oi.each { |oa, ia|
 			case oa
-			when :reg, :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :regfp, :regmmx, :regxmm
+			when :reg, :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :eeet, :regfp, :regmmx, :regxmm, :regymm
 				# field arg
 				set_field[oa, ia.val]
 				pfx << 0x66 if oa == :regmmx and op.props[:xmmx] and ia.sz == 128
+			when :vexvreg, :vexvxmm, :vexvymm
+				set_field[:vex_vvvv, ia.val ^ 0xf]
 			when :imm_val1, :imm_val3, :reg_cl, :reg_eax, :reg_dx, :regfp0
 				# implicit
 			else
@@ -251,7 +254,7 @@ class Ia32
 			end
 		}
 
-		if !(op.args & [:modrm, :modrmA, :modrmxmm, :modrmmmx]).empty?
+		if !(op.args & [:modrm, :modrmmmx, :modrmxmm, :modrmymm]).empty?
 			# reg field of modrm
 			regval = (base[-1] >> 3) & 7
 			base.pop
@@ -265,6 +268,8 @@ class Ia32
 			postponed.first[1] = Expression[target, :-, postlabel]
 		end
 
+		pfx << op.props[:needpfx] if op.props[:needpfx]
+
 		#
 		# append other arguments
 		#
@@ -273,7 +278,7 @@ class Ia32
 		postponed.each { |oa, ia|
 			case oa
 			when :farptr; ed = ia.encode(@endianness, "a#{opsz}".to_sym)
-			when :modrm, :modrmA, :modrmmmx, :modrmxmm
+			when :modrm, :modrmmmx, :modrmxmm, :modrmymm
 				if ia.kind_of? ModRM
 					ed = ia.encode(regval, @endianness)
 					if ed.kind_of?(::Array)
@@ -295,6 +300,7 @@ class Ia32
 			when :mrm_imm; ed = ia.imm.encode("a#{adsz}".to_sym, @endianness)
 			when :i8, :u8, :u16; ed = ia.encode(oa, @endianness)
 			when :i; ed = ia.encode("a#{opsz}".to_sym, @endianness)
+			when :i4xmm, :i4ymm; ed = ia.val << 4	# u8
 			else raise SyntaxError, "Internal error: want to encode field #{oa.inspect} as arg in #{i}"
 			end