Top all-time · #6417
repz ret
Personal blog · repzret.orgprogrammingsecurity
repz ret is a personal blog at repzret.org about programming and security. Since 2012, 12 different Hacker News readers have linked it 14 times, most often “Why do RET instructions have a REPZ prepended on x86?”. It has a working feed you can follow.
Most-linked posts?
- Why do RET instructions have a REPZ prepended on x86?5 people · 5 mentions · first linked 2013-08-26
- repz ret4 people · 4 mentions · first linked 2023-11-14
- The rep prefix and detecting Valgrind (2012)2 people · 3 mentions · first linked 2021-09-21
What Hacker News says?
...so it only took them over three decades to realise the power of REP MOVS/STOS? ;-) On x86, it's been there since the 8086, and can do cacheline-sized pieces at a time on the newer CPUs. This behaviour is detectable in certain edge-cases: https://repzret.org/p/rep-prefix-and-detecting-valgrind/
Comment linking /p/rep-prefix-and-detecting-valgrind/
on “Arm AArch64 Adds Memcpy() Instructions”Submitted Why do RET instructions have a REPZ prepended on x86? as a story · 174 points
HN discussionThe solution is that a string instruction can be interrupted in the middle of the instruction, unlike most instructions. This is true even for later x86 processors that move entire cachelines at a time, and also leads to one sneaky technique for detection of VMs or being debugged/emulated: https://repzret.org/p/rep-prefix-and-detecting-valgrind/ https://silviocesare.wordpress.com/2009/02/02/anti-debugging...
Comment linking /p/rep-prefix-and-detecting-valgrind/
on “The microcode and hardware in the 8086 processor that perform string operations”Submitted The rep prefix and detecting valgrind (2012) as a story · 16 points
HN discussiontedunangst down in the comments linked https://repzret.org/p/repzret/ : "Looking in the old AMD optimisation guide for the then-current K8 processor microarchitecture (the first implementation of 64bit x86!), there is effectively mention of a “Two-Byte Near-Return ret Instruction”. The text goes on to explain in advice 6.2 that “A two-byte ret has a rep instruction inserted before the ret, which produces the functio…
Comment linking /p/repzret/
on “Reptar”Submitted Repz ret as a story · 3 points
HN discussionTheir diagnosis reminds me of what happened when qemu ran into repz ret. https://repzret.org/p/repzret/
Comment linking /p/repzret/
on “Reptar”Submitted repz ret as a story · 2 points
HN discussionSee http://repzret.org/p/repzret/
Comment linking /p/repzret/
on “Google researchers discover 'Reptar', a new CPU vulnerability”Submitted repz ret as a story · 2 points
HN discussionSubmitted repz ret (2012) as a story · 1 points
HN discussionSubmitted The rep prefix and detecting Valgrind (2012) as a story · 1 points
HN discussionSubmitted Repz ret as a story · 1 points
HN discussionSubmitted Detecting valgrind as a story · 1 points
HN discussion
