From 47b92fd8688b72d85de171da8dcc0677797f737a Mon Sep 17 00:00:00 2001
From: mappzor <34216645+mappzor@users.noreply.github.com>
Date: Wed, 6 Nov 2024 01:50:55 +0100
Subject: [PATCH] Fixed VSIB encoding in 16-bit mode

---
 src/Encoder.c                | 8 ++++++--
 tests/re_enc_test_cases.json | 6 ++++++
 tools/ZydisFuzzShared.c      | 4 ++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/Encoder.c b/src/Encoder.c
index 4778ac2e..a9dd7cbc 100644
--- a/src/Encoder.c
+++ b/src/Encoder.c
@@ -2177,9 +2177,13 @@ static ZyanBool ZydisIsMemoryOperandCompatible(ZydisEncoderInstructionMatch *mat
                 return ZYAN_FALSE;
             }
         }
-        else
+        else if (candidate_easz == 16)
         {
-            if (candidate_easz == 16 && !disp_only)
+            if (is_vsib)
+            {
+                candidate_easz = 32;
+            }
+            else if (!disp_only)
             {
                 if (disp_size > 16)
                 {
diff --git a/tests/re_enc_test_cases.json b/tests/re_enc_test_cases.json
index f5f856cc..907bbd1a 100644
--- a/tests/re_enc_test_cases.json
+++ b/tests/re_enc_test_cases.json
@@ -938,5 +938,11 @@
         "stack_width": "ZYDIS_STACK_WIDTH_64",
         "payload": "F3660FA7C86239F6",
         "description": "rep xcrypt_ecb <- TODO: Remove 0x66 byte after fixing OSIZE handling for XCRYPT"
+    },
+    {
+        "machine_mode": "ZYDIS_MACHINE_MODE_LONG_COMPAT_16",
+        "stack_width": "ZYDIS_STACK_WIDTH_16",
+        "payload": "6762C27D2DA00C150000000000000000",
+        "description": "vpscatterdd dword ptr ds:[ymm2*1] {k5}, ymm1"
     }
 ]
\ No newline at end of file
diff --git a/tools/ZydisFuzzShared.c b/tools/ZydisFuzzShared.c
index 64a28270..7ec305ba 100644
--- a/tools/ZydisFuzzShared.c
+++ b/tools/ZydisFuzzShared.c
@@ -111,6 +111,10 @@ void ZydisPrintInstruction(const ZydisDecodedInstruction* instruction,
         ZYAN_UNREACHABLE;
     }
     printf("-%u ", instruction->stack_width);
+    if (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_MVEX)
+    {
+        printf("-knc ");
+    }
 
     for (ZyanU8 i = 0; i < instruction->length; ++i)
     {