Find Two-byte Illegal Opcodes for x86-64

#define _CRT_SECURE_NO_WARNINGS
#include <windows.h>
#include <stdio.h>

// Array of illegal single-byte opcodes
int IllegalSingleByteOpcodes[] = { 0x06 ,0x07, 0x0e, 0x16, 0x17, 0x1e, 0x1f, 0x27, 0x2f, 0x37, 0x3f, 0x60, 0x61, 0xce, 0xd6 };

// Check if a given opcode is illegal
bool is_illegal_opcode(int opcode) {
    for (size_t i = 0; i < sizeof(IllegalSingleByteOpcodes) / sizeof(IllegalSingleByteOpcodes[0]); i++) {
        if (IllegalSingleByteOpcodes[i] == opcode) {
            return true;
        }
    }
    return false;
}

// Create and wait for a process with the given opcodes
void create_and_wait_for_process(int opcode1, int opcode2) {
    // Set up startup and process info
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));

    // Create command line string
    char cmdline[256];
    snprintf(cmdline, sizeof(cmdline), "IllegalOpcodes.exe %d %d", opcode1, opcode2);

    // Create process
    if (!CreateProcess(NULL, cmdline, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)) {
        printf("CreateProcess failed (%d).\n", GetLastError());
        exit(1);
    }

    // Wait for process to finish
    if (WaitForSingleObject(pi.hProcess, 1000) != WAIT_OBJECT_0) {
        TerminateProcess(pi.hProcess, 0);
    }

    // Clean up handles
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
}

int main() {
    // Iterate through all possible opcode pairs
    for (int opcode1 = 0; opcode1 <= 255; opcode1++) {
        // Skip illegal opcodes
        if (is_illegal_opcode(opcode1)) {
            printf("\nSkipping Illegal Opcode 0x%02x ...\n", opcode1);
            continue;
        }
        printf("\nChecking Opcode 0x%02x ...\n", opcode1);

        for (int opcode2 = 0; opcode2 <= 255; opcode2++) {
            create_and_wait_for_process(opcode1, opcode2);
        }
    }

    return 0;
}


------------------- IllegalOpcodes.cpp -------------------


#include <windows.h>
#include <stdio.h>

// Offset to write opcodes at the 4K page end
#define CODE_PAGE_END_OFFSET 0xFFE

// Write two byte opcodes at the 4K page end and execute them
void write_and_execute_opcodes(LPVOID code_page_mem, int opcode1, int opcode2)
{
    *((unsigned char*)code_page_mem + CODE_PAGE_END_OFFSET) = opcode1;
    *((unsigned char*)code_page_mem + CODE_PAGE_END_OFFSET + 1) = opcode2;

    __try
    {
        // Execute opcodes...
        ((void(*)())((unsigned char*)code_page_mem + CODE_PAGE_END_OFFSET))();
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        switch (GetExceptionCode()) {
            case EXCEPTION_ILLEGAL_INSTRUCTION:
                printf("{0x%02x,0x%02x},", opcode1, opcode2);
                break;
            default:
                // Ignore other exceptions
                break;
        }
    }
}

int main(int argc, char* const argv[])
{
    int opcode1 = atoi(argv[1]);
    int opcode2 = atoi(argv[2]);

    LPVOID code_page_mem = VirtualAlloc(NULL, 2, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    DWORD old_protect = VirtualProtect(code_page_mem, 2, PAGE_EXECUTE_READWRITE, &old_protect);

    write_and_execute_opcodes(code_page_mem, opcode1, opcode2);

    VirtualFree(code_page_mem, 0, MEM_RELEASE);

    return 0;
}