[x86] Lift BEXTR with concise intrinsics and correct flags

Use __bextr32 and __bextr64 with named value, start, and length parameters
to keep decompilation compact for both constant and variable controls.
Use the flag system to set ZF from the result, clear CF/OF, and model
AF/SF/PF as unknown. Separate ZF updates to prevent SF from being
incorrectly inferred from the result. Preserve APX flag suppression.

Author: zznop

arch/x86/arch_x86.cpp

@@ -2137,6 +2137,22 @@ size_t X86CommonArchitecture::GetFlagWriteLowLevelIL(BNLowLevelILOperation op, s
 			il.Const(size, 0));
 	}
 
+	if (flagWriteType == IL_FLAGWRITE_BEXTR)
+	{
+		switch (flag)
+		{
+		case IL_FLAG_C:
+		case IL_FLAG_O:
+			return il.Const(0, 0);
+		case IL_FLAG_A:
+		case IL_FLAG_S:
+		case IL_FLAG_P:
+			return il.Unknown();
+		default:
+			break;
+		}
+	}
+
 	if (flagWriteType == IL_FLAGWRITE_PTEST)
 	{
 		switch (flag)
@@ -2935,6 +2951,10 @@ string X86CommonArchitecture::GetFlagWriteTypeName(uint32_t flags)
 		return "cuo";
 	case IL_FLAGWRITE_PTEST:
 		return "ptest";
+	case IL_FLAGWRITE_BEXTR:
+		return "bextr";
+	case IL_FLAGWRITE_Z:
+		return "z";
 	default:
 		return "";
 	}
@@ -2962,7 +2982,7 @@ vector<uint32_t> X86CommonArchitecture::GetAllFlagWriteTypes()
 	return vector<uint32_t> {IL_FLAGWRITE_ALL, IL_FLAGWRITE_NOCARRY, IL_FLAGWRITE_CO,
 		IL_FLAGWRITE_X87COM, IL_FLAGWRITE_X87COMI, IL_FLAGWRITE_X87C1Z, IL_FLAGWRITE_X87RND,
 		IL_FLAGWRITE_VCOMI, IL_FLAGWRITE_POPCNT, IL_FLAGWRITE_LZTZCNT, IL_FLAGWRITE_PAZS,
-		IL_FLAGWRITE_C, IL_FLAGWRITE_SHRD1, IL_FLAGWRITE_CUO, IL_FLAGWRITE_PTEST};
+		IL_FLAGWRITE_C, IL_FLAGWRITE_SHRD1, IL_FLAGWRITE_CUO, IL_FLAGWRITE_PTEST, IL_FLAGWRITE_BEXTR, IL_FLAGWRITE_Z};
 }
 
 BNFlagRole X86CommonArchitecture::GetFlagRole(uint32_t flag, uint32_t semClass)
@@ -3190,6 +3210,10 @@ vector<uint32_t> X86CommonArchitecture::GetFlagsWrittenByFlagWriteType(uint32_t
 		return vector<uint32_t>{ IL_FLAG_C, IL_FLAG_O };
 	case IL_FLAGWRITE_PTEST:
 		return vector<uint32_t>{ IL_FLAG_C, IL_FLAG_P, IL_FLAG_A, IL_FLAG_Z, IL_FLAG_S, IL_FLAG_O };
+	case IL_FLAGWRITE_BEXTR:
+		return vector<uint32_t>{ IL_FLAG_C, IL_FLAG_P, IL_FLAG_A, IL_FLAG_S, IL_FLAG_O };
+	case IL_FLAGWRITE_Z:
+		return vector<uint32_t>{ IL_FLAG_Z };
 	default:
 		return vector<uint32_t>();
 	}

arch/x86/arch_x86_intrinsics.cpp

@@ -37,6 +37,10 @@ string X86CommonArchitecture::GetIntrinsicName(uint32_t intrinsic)
     {
     case INTRINSIC_F2XM1:
         return "__f2xm1";
+    case INTRINSIC_BEXTR32:
+        return "__bextr32";
+    case INTRINSIC_BEXTR64:
+        return "__bextr64";
     case INTRINSIC_FBLD:
         return "__fbld";
     case INTRINSIC_FBST:
@@ -5112,7 +5116,7 @@ vector<uint32_t> X86CommonArchitecture::GetAllIntrinsics()
     vector<uint32_t> allIntrinsics = { INTRINSIC_F2XM1, INTRINSIC_FBLD, INTRINSIC_FBST , INTRINSIC_FSIN,
         INTRINSIC_FCOS, INTRINSIC_FSINCOS, INTRINSIC_FPATAN, INTRINSIC_FPREM, INTRINSIC_FPREM1,
         INTRINSIC_FPTAN, INTRINSIC_FSCALE, INTRINSIC_FXAM, INTRINSIC_FXTRACT, INTRINSIC_FYL2X,
-        INTRINSIC_FYL2XP1};
+        INTRINSIC_FYL2XP1, INTRINSIC_BEXTR32, INTRINSIC_BEXTR64};
 
     allIntrinsics.reserve(allIntrinsics.size() + INTRINSIC_LAST - INTRINSIC_XED_IFORM_INVALID + 1);
     for (uint32_t value = INTRINSIC_XED_IFORM_INVALID;
@@ -5134,6 +5138,12 @@ vector<NameAndType> X86CommonArchitecture::GetIntrinsicInputs(uint32_t intrinsic
 
     switch (intrinsic)
     {
+    case INTRINSIC_BEXTR32:
+    case INTRINSIC_BEXTR64:
+        return {
+            NameAndType("value", Type::IntegerType(intrinsic == INTRINSIC_BEXTR64 ? 8 : 4, false)),
+            NameAndType("start", Type::IntegerType(1, false)),
+            NameAndType("length", Type::IntegerType(1, false))};
     case INTRINSIC_F2XM1:
     case INTRINSIC_FBST:
     case INTRINSIC_FSIN:
@@ -5196,6 +5206,10 @@ vector<Confidence<Ref<Type>>> X86CommonArchitecture::GetIntrinsicOutputs(uint32_
 
     switch (intrinsic)
     {
+    case INTRINSIC_BEXTR32:
+        return {Type::IntegerType(4, false)};
+    case INTRINSIC_BEXTR64:
+        return {Type::IntegerType(8, false)};
     case INTRINSIC_F2XM1:
     case INTRINSIC_FBLD:
     case INTRINSIC_FPATAN:

arch/x86/il.cpp

@@ -982,6 +982,23 @@ bool GetLowLevelILForInstruction(Architecture* arch, const uint64_t addr, LowLev
 				0)));
 		break;
 
+	case XED_ICLASS_BEXTR:
+	{
+		// Keep extraction atomic and expose the packed control as named start/length inputs.
+		// A temporary result also preserves inputs when the destination aliases the control.
+		il.AddInstruction(il.Intrinsic({RegisterOrFlag::Register(LLIL_TEMP(0))},
+			opOneLen == 8 ? INTRINSIC_BEXTR64 : INTRINSIC_BEXTR32,
+			{ReadILOperand(il, xedd, addr, 1, 1),
+				il.LowPart(1, ReadILOperand(il, xedd, addr, 2, 2)),
+				il.LowPart(1, il.LogicalShiftRight(opTreLen, ReadILOperand(il, xedd, addr, 2, 2), il.Const(1, 8)))},
+			noFlags ? 0 : IL_FLAGWRITE_BEXTR));
+		// Only ZF depends on the result. Keep unspecified flags on the intrinsic so that
+		// semantic flag resolution cannot infer SF from the destination's sign bit.
+		il.AddInstruction(il.Operand(0, il.SetRegister(opOneLen, xed_decoded_inst_get_reg(xedd, opOne_name),
+			il.Register(opOneLen, LLIL_TEMP(0)), noFlags ? 0 : IL_FLAGWRITE_Z)));
+		break;
+	}
+
 	case XED_ICLASS_BT:
 		il.AddInstruction(il.SetFlag(IL_FLAG_C,
 			il.TestBit(opOneLen,

arch/x86/il.h

@@ -57,6 +57,8 @@ struct DISASSEMBLY_OPTIONS
 #define IL_FLAGWRITE_SHRD1   13
 #define IL_FLAGWRITE_CUO     14
 #define IL_FLAGWRITE_PTEST   15
+#define IL_FLAGWRITE_BEXTR   16
+#define IL_FLAGWRITE_Z       17
 
 #define IL_FLAG_CLASS_INT     0 // Default
 #define IL_FLAG_CLASS_X87COM  1
@@ -114,6 +116,8 @@ enum X86_INTRINSIC
     INTRINSIC_FXTRACT,
     INTRINSIC_FYL2X,
     INTRINSIC_FYL2XP1,
+    INTRINSIC_BEXTR32,
+    INTRINSIC_BEXTR64,
     // below are for vector instrinsics
     // copied from public/arch/x86/xedInc/xed-iform-enum.h
     INTRINSIC_XED_IFORM_INVALID = 1000,