Skip to content

Instantly share code, notes, and snippets.

@erikbergenholtz
Created January 14, 2020 07:07
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save erikbergenholtz/a653d46db64c2ce490af91698f75e992 to your computer and use it in GitHub Desktop.
Save erikbergenholtz/a653d46db64c2ce490af91698f75e992 to your computer and use it in GitHub Desktop.
Instruction mapping used for packer detection using deep learning
cmove
cmovne
cmova
cmovae
cmovb
cmovbe
cmovg
cmovge
cmovl
cmovle
cmovo
cmovno
cmovs
cmovns
cmovp
cmovnp
xchg
bswap
xadd
cmpxchg
cmpxchg8b
push
pusha
pushaw
pushf
pushfw
pushw
pop
popa
popaw
popf
popfw
popw
cwd
cwde
cdq
cdqe
cbw
movsx
movsxd
movzx
adc
sub
subpd
subps
subsd
subss
sbb
imul
idiv
inc
dec
neg
daa
das
aaa
aas
aam
aad
and
andnpd
andnps
andpd
andps
or
orpd
orps
xor
xorpd
xorps
not
notrack
sar
shr
shrd
shl
shld
shlx
ror
rol
rcr
rcl
bt
btc
btr
bts
bsf
bsr
sete
setne
seta
setae
setb
setbe
setg
setge
setl
setle
sets
setns
seto
setno
setp
setnp
test
jmp
jmpw
je
jecxz
jne
ja
jae
jb
jbe
jg
jge
jl
jle
jcxz
jo
jno
js
jns
jnp
jp
loop
loope
loopne
call
callw
ret
retf
retfw
retw
iret
iretq
iretw
int
int3
into
bound
enter
enterw
leave
leavew
movsd
cmps
cmpsd
cmpss
scas
lods
stos
rep
repnz
repz
out
outs
ins
insertq
stc
clc
cmc
cld
std
lahf
sahf
sti
cli
lds
les
lfs
lgs
lss
nop
nop/reserved
ud0
ud1
ud2
xlat
cpuid
prefetchw
prefetchwt1
clflush
clflushopt
xsave
xsavec
xsaveopt
xsaves
xrstor
xrstors
xgetbv
rdrand
rdseed
bextr
blsic
blsmsk
lzcnt
pextrw
fld
fld1
fldcw
fldenv
fldenvw
fldl2e
fldl2t
fldlg2
fldln2
fldpi
fldz
fst
fstcw
fstenv
fstenvw
fstp
fstsw
fild
fist
fistp
fisttp
fbld
fbstp
fxch
fcmove
fcmovne
fcmovb
fcmovbe
fcmovnb
fcmovnbe
fcmovu
fcmovnu
fadd
faddp
fiadd
fsub
fsubp
fsubr
fsubrp
fisub
fisubr
fmul
fmulp
fimul
fdiv
fdivp
fdivr
fdivrp
fidiv
fidivr
fprem
fprem1
fabs
fchs
frndint
fscale
fsqrt
fxtract
fcom
fcomi
fcomip
fcomp
fcompp
fucom
fucomi
fucomip
fucomp
fucompp
ficom
ficomp
ftst
fxam
fsin
fsincos
fcos
fptan
fpatan
fyl2x
fyl2xp1
fincstp
fdecstp
ffree
ffreep
finit
fninit
fclex
fnclex
fnstcw
fnstenv
fnstenvw
fsave
fnsave
fnsavew
frstor
frstorw
fnstsw
fwait
fnop
fxsave
fxrstor
movd
movddup
movdq2q
movdqa
movdqu
movq
movq2dq
packsswb
packssdw
packuswb
punpckhbw
punpckhwd
punpckhdq
punpcklbw
punpcklwd
punpckldq
paddb
paddw
paddd
paddsb
paddsw
paddusb
paddusw
psubb
psubw
psubd
psubsb
psubsw
psubusb
psubusw
pmulhw
pmullw
pmaddwd
pcmpeqb
pcmpeqw
pcmpeqd
pcmpgtb
pcmpgtw
pcmpgtd
pand
pandn
por
pxor
psllw
pslld
pslldq
psllq
psrlw
psrld
psrldq
psrlq
psraw
psrad
emms
movaps
movups
movhps
movhlps
movlps
movlhps
movmskps
movss
addps
addss
mulps
mulss
divps
divss
rcpps
rcpss
sqrtps
sqrtss
rsqrtps
rsqrtss
maxps
maxss
minps
minss
cmpps
comiss
ucomiss
shufps
unpckhps
unpcklps
cvtpi2ps
cvtsi2ss
cvtps2pi
cvttps2pi
cvtss2si
cvttss2si
ldmxcsr
stmxcsr
pavgb
pavgw
pinsrw
pmaxub
pmaxsw
pminub
pminsw
pmovmskb
pmulhuw
psadbw
pshufw
maskmovq
movntq
movntps
sfence
movapd
movupd
movhpd
movlpd
movmskpd
addpd
addsd
mulpd
mulsd
divpd
divsd
sqrtpd
sqrtsd
maxpd
maxsd
minpd
minsd
cmppd
comisd
ucomisd
shufpd
unpckhpd
unpcklpd
cvtpd2pi
cvttpd2pi
cvtpi2pd
cvtpd2dq
cvttpd2dq
cvtdq2pd
cvtps2pd
cvtpd2ps
cvtss2sd
cvtsd2ss
cvtsd2si
cvttsd2si
cvtsi2sd
cvtdq2ps
cvtps2dq
cvttps2dq
pmuludq
paddq
psubq
pshuflw
pshufhw
pshufd
punpckhqdq
punpcklqdq
lfence
mfence
pause
maskmovdqu
movnti
lddqu
addsubps
addsubpd
haddps
hsubps
haddpd
hsubpd
movshdup
movsldup
monitor
monitorx
mwait
mwaitx
phaddw
phaddsw
phaddd
phsubw
phsubsw
phsubd
pabsb
pabsw
pabsd
pmaddubsw
pmulhrsw
pshufb
psignw
palignr
pinsrb
pcmpistri
pclmulqdq
vcvtps2ph
xabort
xacquire
xrelease
xbegin
xbeginw
xend
xtest
sha1msg1
sha1msg2
sha1nexte
sha1rnds4
sha256msg1
sha256msg2
sha256rnds2
valignd
vblendmpd
vblendmps
vcompressps
vcvttps2udq
vcvttsd2usi
vcvtss2usi
vexpandps
vextractf64x4
vgetexppd
vgetexpps
vgetmantss
vmovdqa32
vmovdqu32
vpbroadcastd
vpbroadcastq
vpcmpuq
vpcompressq
vpcompressd
vpermi2d
vpermi2pd
vpermi2ps
vpermt2d
vpermt2q
vpermt2pd
vpermt2ps
vpexpandd
vpmaxud
vpminud
vpmovqw
vpmovsqw
vpmovsqd
vpmovusqd
vpmovdb
vpmovdw
vprolvd
vpscatterdd
vpscatterqq
vptestnmd
vptestnmq
vrcp14sd
vrcp14ss
vrndscaless
vshuff32x4
vshufi32x4
vcvtuqq2pd
vcvtuqq2ps
vfpclasspd
vfpclassps
vpmovm2q
vpmullq
vrangeps
vrangess
vreduceps
vreducess
vpbroadcastb
vpbroadcastw
vpcmpb
vpcmpuw
vpermw
vpmovm2b
vpsllvw
vpconflictd
vpconflictq
vplzcntd
kaddb
kaddw
kandb
kandw
kandnb
kandnw
kmovb
kmovw
knotb
knotw
knotq
korb
korw
kortestb
kortestw
kshiftrd
ktestb
ktestw
kunpckbw
kunpckwd
kxnorb
kxnorw
kxorb
kxorw
vrcp28ss
vrsqrt28pd
vrsqrt28ss
clac
stac
lgdtd
sgdt
sgdtd
lldt
sldt
ltr
lidt
lidtd
sidt
sidtd
lmsw
smsw
clts
arpl
lar
lsl
verr
verw
invd
wbinvd
invlpg
invlpga
lock
hlt
rsm
rdmsr
wrmsr
rdpmc
rdtsc
rdtscp
sysenter
sysexit
xsetbv
swapgs
syscall
sysret
sysretw
vmptrld
vmptrst
vmread
vmwrite
vmlaunch
vmresume
vmxoff
vmcall
bndmk
bndcl
bndcu
bndcn
bndmov
bndldx
bndstx
add
addr16
addr32
(bad)
blcfill
blci
blcic
blcmsk
blcs
bnd
.byte
clgi
clzero
cmp
cmpeqps
cmpeqsd
cmpleps
cmpltps
cmpltss
cmpnleps
cmpnless
cmpnltps
cmpordps
cmpunordps
cqo
cs
data16
div
ds
encls
es
extrq
f2xm1
fdisi(8087
femms
feni(8087
fndisi(8087
fneni(8087
fnsetpm(287
frstpm(287
fs
fsetpm(287
getsec
gs
icebp
in
jrcxz
kmovd
lea
llwpcb
lwpins
lwpval
montmul
mov
movabs
movntsd
movntss
movs
mul
pavgusb
pf2id
pf2iw
pfacc
pfadd
pfcmpge
pfcmpgt
pfmax
pfmin
pfmul
pfnacc
pfpnacc
pfrcp
pfrcpit1
pfrcpit2
pfrsqit1
pfrsqrt
pfsub
pi2fd
pi2fw
pmulhrw
prefetch
prefetchnta
prefetcht0
prefetcht1
prefetcht2
pswapd
rdpkru
rex
rex.B
rex.R
rex.RB
rex.RX
rex.RXB
rex.W
rex.WB
rex.WR
rex.WRB
rex.WRX
rex.WRXB
rex.WX
rex.WXB
rex.X
rex.XB
skinit
slwpcb
ss
stgi
str
t1mskc
tzmsk
v4fmaddss
v4fnmaddps
v4fnmaddss
vaddpd
vaddps
vaddsd
vaddss
vaddsubpd
vaddsubps
vaesdec
vaesdeclast
vaesenc
vaesenclast
vaeskeygenassist
vandnpd
vandnps
vandpd
vandps
vblendps
vblendvpd
vbroadcasti64x2
vbroadcasti64x4
vbroadcastss
vcmpeqps
vcmpeqsd
vcmpeqss
vcmpeq_uqss
vcmpfalse_osss
vcmpfalsess
vcmpge_oqsd
vcmplepd
vcmpleps
vcmplt_oqps
vcmpneq_ospd
vcmpneqsd
vcmpneq_usps
vcmpngtpd
vcmpnlesd
vcmpnltps
vcmpordps
vcmpord_spd
vcmppd
vcmpps
vcmpsd
vcmpss
vcmptrue_usps
vcomisd
vcomiss
vcvtdq2pd
vcvtdq2ps
vcvtpd2dq
vcvtpd2ps
vcvtps2dq
vcvtps2pd
vcvtsd2si
vcvtsd2ss
vcvtsi2sd
vcvtsi2ss
vcvtss2sd
vcvtss2si
vcvttpd2dq
vcvttps2dq
vcvttsd2si
vcvttss2si
vcvtusi2sd
vcvtusi2ss
vdivpd
vdivps
vdivsd
vdivss
vdpps
vextractps
vfmadd132ps
vfmadd213pd
vfmadd213sd
vfmadd213ss
vfmadd231ps
vfmadd231ss
vfmaddpd
vfmaddsub132pd
vfmaddsub132ps
vfmaddsub213pd
vfmaddsub213ps
vfmaddsub231pd
vfmaddsubpd
vfmsub213sd
vfmsub213ss
vfmsub231ps
vfmsub231sd
vfmsubadd132pd
vfmsubadd132ps
vfmsubadd213pd
vfmsubadd213ps
vfmsubadd231pd
vfmsubaddps
vfmsubpd
vfmsubps
vfnmadd132pd
vfnmadd132sd
vfnmadd132ss
vfnmadd213pd
vfnmadd213ps
vfnmadd213ss
vfnmadd231pd
vfnmadd231ps
vfnmadd231sd
vfnmadd231ss
vfnmaddsd
vfnmsub132pd
vfnmsub132ss
vfnmsub213pd
vfnmsub213ps
vfnmsub213ss
vfnmsub231ss
vfnmsubpd
vfnmsubps
vfnmsubss
vfrczpd
vfrczps
vfrczsd
vfrczss
vgatherqpd
vgatherqps
vgf2p8mulb
vhaddpd
vhaddps
vhsubpd
vhsubps
vinsertf128
vinserti32x8
vinsertps
vlddqu
vldmxcsr
vmaskmovdqu
vmaskmovpd
vmaskmovps
vmaxpd
vmaxps
vmaxsd
vmaxss
vminpd
vminps
vminsd
vminss
vmload
vmmcall
vmovapd
vmovaps
vmovd
vmovddup
vmovdqa
vmovdqu
vmovhlps
vmovhpd
vmovhps
vmovlhps
vmovlpd
vmovlps
vmovmskpd
vmovmskps
vmovntdq
vmovntdqa
vmovntpd
vmovntps
vmovq
vmovsd
vmovshdup
vmovsldup
vmovss
vmovupd
vmovups
vmsave
vmulpd
vmulps
vmulsd
vmulss
vorpd
vorps
vp4dpwssds
vpabsb
vpabsd
vpabsw
vpackssdw
vpacksswb
vpackusdw
vpackuswb
vpaddb
vpaddd
vpaddq
vpaddsb
vpaddsw
vpaddusb
vpaddusw
vpaddw
vpalignr
vpand
vpandd
vpandn
vpandnd
vpandnq
vpandq
vpavgb
vpavgw
vpblendvb
vpblendw
vpclmulqdq
vpcmov
vpcmpeqb
vpcmpeqd
vpcmpeqq
vpcmpeqw
vpcmpestri
vpcmpgtb
vpcmpgtd
vpcmpgtw
vpcomb
vpcomd
vpcompressw
vpcomq
vpcomub
vpcomud
vpcomuq
vpcomuw
vpcomw
vpdpbusds
vpdpwssd
vperm2i128
vpermil2pd
vpermil2ps
vpermilpd
vpermilps
vpermpd
vpermps
vpermt2b
vpextrw
vpgatherdd
vpgatherdq
vpgatherqd
vpgatherqq
vphaddbd
vphaddbq
vphaddbw
vphadddq
vphaddsw
vphaddubd
vphaddubq
vphaddubw
vphaddudq
vphadduwd
vphadduwq
vphaddw
vphaddwd
vphaddwq
vphminposuw
vphsubbw
vphsubd
vphsubdq
vphsubsw
vphsubwd
vpinsrq
vpinsrw
vpmacsdd
vpmacsdqh
vpmacsdql
vpmacssdd
vpmacssdqh
vpmacssdql
vpmacsswd
vpmacssww
vpmacswd
vpmacsww
vpmadcsswd
vpmadcswd
vpmaddubsw
vpmaddwd
vpmaskmovd
vpmaxsb
vpmaxsd
vpmaxsw
vpmaxub
vpmaxuw
vpminsb
vpminsw
vpminub
vpminuw
vpmovmskb
vpmovsxbd
vpmovsxbq
vpmovsxbw
vpmovsxwq
vpmovzxbq
vpmovzxwd
vpmulhrsw
vpmulhuw
vpmulhw
vpmulld
vpmullw
vpmuludq
vpopcntb
vpopcntd
vpopcntq
vpor
vpperm
vprorvq
vprotb
vprotd
vprotq
vprotw
vpsadbw
vpshab
vpshad
vpshaq
vpshaw
vpshlb
vpshld
vpshldd
vpshldvw
vpshlq
vpshlw
vpshrdvd
vpshufb
vpshufbitqmb
vpshufd
vpshufhw
vpshuflw
vpsignb
vpslld
vpslldq
vpsllq
vpsllvd
vpsllvq
vpsllw
vpsrad
vpsraw
vpsrld
vpsrldq
vpsrlq
vpsrlvd
vpsrlvq
vpsrlw
vpsubb
vpsubd
vpsubq
vpsubsb
vpsubsw
vpsubusb
vpsubusw
vpsubw
vpternlogd
vpternlogq
vpunpckhbw
vpunpckhdq
vpunpckhqdq
vpunpckhwd
vpunpcklbw
vpunpckldq
vpunpcklqdq
vpunpcklwd
vpxor
vrcpps
vrcpss
vroundpd
vroundps
vroundsd
vroundss
vrsqrtps
vrsqrtss
vscalefpd
vscalefps
vscalefsd
vshufpd
vshufps
vsqrtpd
vsqrtps
vsqrtsd
vsqrtss
vstmxcsr
vsubpd
vsubps
vsubsd
vsubss
vtestpd
vucomisd
vucomiss
vunpckhpd
vunpckhps
vunpcklpd
vunpcklps
vxorpd
vxorps
vzeroall
vzeroupper
wrpkru
wrssd
xcrypt-cbc
xcrypt-cfb
xcrypt-ctr
xcrypt-ecb
xcrypt-ofb
xsha1
xsha256
xstore-rng
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment