From 088456986b6acd52fb16b3544d374049cea61876 Mon Sep 17 00:00:00 2001
From: Mark Rowe <mark@vector35.com>
Date: Tue, 25 Aug 2026 13:41:03 -0700
Subject: [PATCH] [aarch64] Disassemble and lift instructions in FEAT_PAuth_LR

---
 arch/arm64/arch_arm64.cpp                   | 24 +++++
 arch/arm64/arm64test.py                     | 98 ++++++++++++++++++++-
 arch/arm64/disassembler/decode_scratchpad.c | 31 ++++++-
 arch/arm64/il.cpp                           | 72 +++++++++++++++
 arch/arm64/il.h                             |  6 ++
 5 files changed, 229 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/arch_arm64.cpp b/arch/arm64/arch_arm64.cpp
index 0f11a40de2..5e1383bb58 100644
--- a/arch/arm64/arch_arm64.cpp
+++ b/arch/arm64/arch_arm64.cpp
@@ -399,6 +399,10 @@ class Arm64Architecture : public Architecture
 		case ARM64_RET:
 		case ARM64_RETAA:
 		case ARM64_RETAB:
+		case ARM64_RETAASPPC:
+		case ARM64_RETABSPPC:
+		case ARM64_RETAASPPCR:
+		case ARM64_RETABSPPCR:
 			result.AddBranch(FunctionReturn);
 			break;
 		case ARM64_SVC:
@@ -961,6 +965,14 @@ class Arm64Architecture : public Architecture
 			return "__autia";
 		case ARM64_INTRIN_AUTIB:
 			return "__autib";
+		case ARM64_INTRIN_AUTIA2:
+			return "__autia2";
+		case ARM64_INTRIN_AUTIB2:
+			return "__autib2";
+		case ARM64_INTRIN_PACIA2:
+			return "__pacia2";
+		case ARM64_INTRIN_PACIB2:
+			return "__pacib2";
 		case ARM64_INTRIN_ISB:
 			return "__isb";
 		case ARM64_INTRIN_WFE:
@@ -993,6 +1005,8 @@ class Arm64Architecture : public Architecture
 			return "SystemHintOp_CSDB";
 		case ARM64_INTRIN_HINT_BTI:
 			return "SystemHintOp_BTI";
+		case ARM64_INTRIN_HINT_PACM:
+			return "SystemHintOp_PACM";
 		case ARM64_INTRIN_SEV:
 			return "__sev";
 		case ARM64_INTRIN_SEVL:
@@ -1157,6 +1171,12 @@ class Arm64Architecture : public Architecture
 		case ARM64_INTRIN_PACIA:      // reads <Xd>, <Xn>
 		case ARM64_INTRIN_PACIB:      // reads <Xd>, <Xn>
 			return {NameAndType(Type::IntegerType(8, false)), NameAndType(Type::IntegerType(8, false))};
+		case ARM64_INTRIN_AUTIA2:     // reads <Xd>, modifier, modifier2
+		case ARM64_INTRIN_AUTIB2:     // reads <Xd>, modifier, modifier2
+		case ARM64_INTRIN_PACIA2:     // reads <Xd>, modifier, modifier2
+		case ARM64_INTRIN_PACIB2:     // reads <Xd>, modifier, modifier2
+			return {NameAndType(Type::IntegerType(8, false)), NameAndType(Type::IntegerType(8, false)),
+				NameAndType(Type::IntegerType(8, false))};
 		case ARM64_INTRIN_TLBI:      // reads <tlbi_op>, <Xn>
 			return {
 				NameAndType("tlbi_op", Confidence<Ref<Type>>(Type::EnumerationType(this, get_tlbi_op_enum(), 4, false), BN_FULL_CONFIDENCE))
@@ -1206,6 +1226,10 @@ class Arm64Architecture : public Architecture
 		case ARM64_INTRIN_PACIA:      // writes <Xd>
 		case ARM64_INTRIN_PACGA:      // writes <Xd>
 		case ARM64_INTRIN_PACIB:      // writes <Xd>
+		case ARM64_INTRIN_AUTIA2:     // writes <Xd>
+		case ARM64_INTRIN_AUTIB2:     // writes <Xd>
+		case ARM64_INTRIN_PACIA2:     // writes <Xd>
+		case ARM64_INTRIN_PACIB2:     // writes <Xd>
 		case ARM64_INTRIN_XPACD:      // writes <Xd>
 		case ARM64_INTRIN_XPACI:      // writes <Xd>
 		case ARM64_INTRIN_CNT:        // writes <Xd>
diff --git a/arch/arm64/arm64test.py b/arch/arm64/arm64test.py
index 47ae6c8c60..e1e2c80aae 100755
--- a/arch/arm64/arm64test.py
+++ b/arch/arm64/arm64test.py
@@ -78,6 +78,22 @@
     # retab (example of encoding: RETAB_64E_branch_reg)
     (b'\xFF\x0F\x5F\xD6', 'LLIL_RET(LLIL_REG.q(lr))', ATTR_PTR_AUTH),
 
+    # RETURN FROM SUBROUTINE, WITH POINTER AUTHENTICATION AGAINST SP AND PC (FEAT_PAuth_LR)
+    # the operand is part of the authentication modifier rather than the address returned to, which
+    # is always lr
+    # retaasppc <label> (example of encoding: RETAASPPC_only_miscbranch)
+    (b'\x3F\x00\x00\x55', 'LLIL_RET(LLIL_REG.q(lr))', ATTR_PTR_AUTH),
+    # retabsppc <label> (example of encoding: RETABSPPC_only_miscbranch)
+    (b'\x3F\x00\x20\x55', 'LLIL_RET(LLIL_REG.q(lr))', ATTR_PTR_AUTH),
+    # retaasppcr x3 (example of encoding: RETAASPPCR_64M_branch_reg)
+    (b'\xE3\x0B\x5F\xD6', 'LLIL_RET(LLIL_REG.q(lr))', ATTR_PTR_AUTH),
+    # retabsppcr x12 (example of encoding: RETABSPPCR_64M_branch_reg)
+    (b'\xEC\x0F\x5F\xD6', 'LLIL_RET(LLIL_REG.q(lr))', ATTR_PTR_AUTH),
+
+    # HINT THAT A DIFFERENT POINTER AUTHENTICATION MODIFIER IS IN USE (FEAT_PAuth_LR)
+    # pacm (example of encoding: PACM_HI_hints)
+    (b'\xFF\x24\x03\xD5', 'LLIL_INTRINSIC([],SystemHintOp_PACM,[])'),
+
     # mixed instructions from old tests
     # BLRAA_64P_branch_reg 1101011100111111000010xxxxxxxxxx
     (b'\x14\x0B\x3F\xD7', 'LLIL_CALL(LLIL_REG.q(x24))', ATTR_PTR_AUTH), # blraa x24, x20
@@ -187,6 +203,24 @@
     # xpaci x25 (example of encoding: XPACI_64Z_dp_1src)
     (b'\xF9\x43\xC1\xDA', 'LLIL_INTRINSIC([x25],__xpaci,[LLIL_REG.q(x25)])'),
 
+    # SIGN OR AUTHENTICATE AGAINST TWO MODIFIERS (FEAT_PAuth_LR)
+    # the 171615 forms take x17 as the address and x16 and x15 as the modifiers
+    # the sppcr forms take x30 as the address and sp and <Xn> as the modifiers
+    # the forms whose second modifier is the instruction's own address are position dependent, so
+    # they are in tests_pac_position_dependent instead
+    # pacia171615 (example of encoding: PACIA171615_64LR_dp_1src)
+    (b'\xFE\x8B\xC1\xDA', 'LLIL_INTRINSIC([x17],__pacia2,[LLIL_REG.q(x17),LLIL_REG.q(x16),LLIL_REG.q(x15)])'),
+    # pacib171615 (example of encoding: PACIB171615_64LR_dp_1src)
+    (b'\xFE\x8F\xC1\xDA', 'LLIL_INTRINSIC([x17],__pacib2,[LLIL_REG.q(x17),LLIL_REG.q(x16),LLIL_REG.q(x15)])'),
+    # autia171615 (example of encoding: AUTIA171615_64LR_dp_1src)
+    (b'\xFE\xBB\xC1\xDA', 'LLIL_INTRINSIC([x17],__autia2,[LLIL_REG.q(x17),LLIL_REG.q(x16),LLIL_REG.q(x15)])'),
+    # autib171615 (example of encoding: AUTIB171615_64LR_dp_1src)
+    (b'\xFE\xBF\xC1\xDA', 'LLIL_INTRINSIC([x17],__autib2,[LLIL_REG.q(x17),LLIL_REG.q(x16),LLIL_REG.q(x15)])'),
+    # autiasppcr x5 (example of encoding: AUTIASPPCR_64LRR_dp_1src)
+    (b'\xBE\x90\xC1\xDA', 'LLIL_INTRINSIC([lr],__autia2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_REG.q(x5)])'),
+    # autibsppcr x9 (example of encoding: AUTIBSPPCR_64LRR_dp_1src)
+    (b'\x3E\x95\xC1\xDA', 'LLIL_INTRINSIC([lr],__autib2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_REG.q(x9)])'),
+
     # mixed instructions from old tests
     # PACDA_64P_dp_1src 1101101011000001000010xxxxxxxxxx
     (b'\xAC\x0B\xC1\xDA', 'LLIL_INTRINSIC([x12],__pacda,[LLIL_REG.q(x12),LLIL_REG.q(fp)])'), # pacda x12, x29
@@ -237,6 +271,28 @@
     # XPACLRI_HI_hints 11010101000000110010000xxxxxxxxx
     (b'\xFF\x20\x03\xD5', 'LLIL_INTRINSIC([lr],__xpaci,[LLIL_REG.q(lr)])'), # xpaclri
     ])
+
+    # The remaining FEAT_PAuth_LR signing and authenticating instructions take the instruction's own
+    # address as their second modifier, so the address they are lifted at reaches the IL. Each case
+    # gives the address to lift at and the IL that must be produced there, and is appended to
+    # tests_position_dependent below.
+    tests_pac_position_dependent = [
+        # paciasppc (example of encoding: PACIASPPC_64LR_dp_1src)
+        (b'\xFE\xA3\xC1\xDA', 0x1000, 'LLIL_INTRINSIC([lr],__pacia2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0x1000)])'),
+        (b'\xFE\xA3\xC1\xDA', 0x2004, 'LLIL_INTRINSIC([lr],__pacia2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0x2004)])'),
+        # pacibsppc (example of encoding: PACIBSPPC_64LR_dp_1src)
+        (b'\xFE\xA7\xC1\xDA', 0x1000, 'LLIL_INTRINSIC([lr],__pacib2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0x1000)])'),
+        # pacnbiasppc, which signs without setting the branch target (example of encoding: PACNBIASPPC_64LR_dp_1src)
+        (b'\xFE\x83\xC1\xDA', 0x1000, 'LLIL_INTRINSIC([lr],__pacia2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0x1000)])'),
+        # pacnbibsppc (example of encoding: PACNBIBSPPC_64LR_dp_1src)
+        (b'\xFE\x87\xC1\xDA', 0x1000, 'LLIL_INTRINSIC([lr],__pacib2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0x1000)])'),
+        # autiasppc <label> -- the label is the address minus the encoded offset, here 4
+        # (example of encoding: AUTIASPPC_only_dp_1src_imm)
+        (b'\x3F\x00\x80\xF3', 0x1000, 'LLIL_INTRINSIC([lr],__autia2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0xFFC)])'),
+        (b'\x3F\x00\x80\xF3', 0x2004, 'LLIL_INTRINSIC([lr],__autia2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0x2000)])'),
+        # autibsppc <label> (example of encoding: AUTIBSPPC_only_dp_1src_imm)
+        (b'\x3F\x00\xA0\xF3', 0x1000, 'LLIL_INTRINSIC([lr],__autib2,[LLIL_REG.q(lr),LLIL_REG.q(sp),LLIL_CONST.q(0xFFC)])'),
+    ]
 # DO NOT LIFT PAC AS INTRINSIC
 else:
     print('testing that select PAC instructions lift to NOP', file=sys.stderr)
@@ -294,8 +350,25 @@
     (b'\xE2\x43\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # xpaci x2
     (b'\xE7\x43\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # xpaci x7
     (b'\xFF\x20\x03\xD5', 'LLIL_NOP()', ATTR_PTR_AUTH), # xpaclri
+    # The FEAT_PAuth_LR sign and authenticate instructions, which take a second modifier.
+    (b'\xFE\x8B\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # pacia171615
+    (b'\xFE\x8F\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # pacib171615
+    (b'\xFE\xBB\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # autia171615
+    (b'\xFE\xBF\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # autib171615
+    (b'\xBE\x90\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # autiasppcr x5
+    (b'\x3E\x95\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # autibsppcr x9
+    (b'\xFE\xA3\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # paciasppc
+    (b'\xFE\xA7\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # pacibsppc
+    (b'\xFE\x83\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # pacnbiasppc
+    (b'\xFE\x87\xC1\xDA', 'LLIL_NOP()', ATTR_PTR_AUTH), # pacnbibsppc
+    (b'\x3F\x00\x80\xF3', 'LLIL_NOP()', ATTR_PTR_AUTH), # autiasppc <label>
+    (b'\x3F\x00\xA0\xF3', 'LLIL_NOP()', ATTR_PTR_AUTH), # autibsppc <label>
     ])
 
+    # Lifted as a NOP none of these carry an address, so they are position independent and are
+    # covered above rather than in tests_position_dependent.
+    tests_pac_position_dependent = []
+
 tests_load_acquire_store_release = [
     # LDAPURB <Wt>, [<Xn|SP>{, #<simm>}]
     (b'\xBE\xE3\x53\x19', 'LLIL_SET_REG.d(w30,LLIL_ZX.d(LLIL_LOAD.b(LLIL_ADD.q(LLIL_REG.q(fp),LLIL_CONST.q(0xFFFFFFFFFFFFFF3E)))))'), # ldapurb w30, [fp, #-0xc2]
@@ -12881,6 +12954,29 @@
     # op 17 is the enable/disable pair, whose operand selects between them
     (b'\x20\x12\x20\x00', 'amx_set '),
     (b'\x21\x12\x20\x00', 'amx_clr '),
+
+    # FEAT_PAuth_LR. Most of these lift to a NOP, so their operands only show up here.
+    # the registers each of these works on are fixed by the encoding, leaving no operands to render
+    (b'\xfe\xa3\xc1\xda', 'paciasppc '),
+    (b'\xfe\xa7\xc1\xda', 'pacibsppc '),
+    (b'\xfe\x83\xc1\xda', 'pacnbiasppc '),
+    (b'\xfe\x87\xc1\xda', 'pacnbibsppc '),
+    (b'\xfe\x8b\xc1\xda', 'pacia171615 '),
+    (b'\xfe\x8f\xc1\xda', 'pacib171615 '),
+    (b'\xfe\xbb\xc1\xda', 'autia171615 '),
+    (b'\xfe\xbf\xc1\xda', 'autib171615 '),
+    (b'\xff\x24\x03\xd5', 'pacm    '),
+    # the modifier is a register
+    (b'\xbe\x90\xc1\xda', 'autiasppcr x5'),
+    (b'\x3e\x95\xc1\xda', 'autibsppcr x9'),
+    (b'\xe3\x0b\x5f\xd6', 'retaasppcr x3'),
+    (b'\xec\x0f\x5f\xd6', 'retabsppcr x12'),
+    # the modifier is a label the encoding reaches by subtracting from the address, here by 4, so at
+    # address 0 it is the address just below zero rather than one just above it
+    (b'\x3f\x00\x80\xf3', 'autiasppc 0xfffffffffffffffc'),
+    (b'\x3f\x00\xa0\xf3', 'autibsppc 0xfffffffffffffffc'),
+    (b'\x3f\x00\x00\x55', 'retaasppc 0xfffffffffffffffc'),
+    (b'\x3f\x00\x20\x55', 'retabsppc 0xfffffffffffffffc'),
 ]
 
 test_cases = \
@@ -12959,7 +13055,7 @@
     (b'\x06\x01\x00\x98', 0x0, 'LLIL_SET_REG.q(x6,LLIL_SX.q(LLIL_LOAD.d(LLIL_CONST.q(0x20))))'),
     (b'\x06\x01\x00\x98', 0x8000, 'LLIL_SET_REG.q(x6,LLIL_SX.q(LLIL_LOAD.d(LLIL_CONST.q(0x8020))))'),
     (b'\x06\x01\x00\x98', 0x8004, 'LLIL_SET_REG.q(x6,LLIL_SX.q(LLIL_LOAD.d(LLIL_CONST.q(0x8024))))'),
-]
+] + tests_pac_position_dependent
 
 # The encodings above, which must not be lifted from the shared view.
 position_dependent_encodings = {data for data, _, _ in tests_position_dependent}
diff --git a/arch/arm64/disassembler/decode_scratchpad.c b/arch/arm64/disassembler/decode_scratchpad.c
index d116098010..b492613ddd 100644
--- a/arch/arm64/disassembler/decode_scratchpad.c
+++ b/arch/arm64/disassembler/decode_scratchpad.c
@@ -1574,10 +1574,12 @@ int decode_scratchpad(context* ctx, Instruction* instr)
 
 	switch (instr->encoding)
 	{
-	/* instrucitons with no operands */
+	/* instructions with no operands */
+	case ENC_AUTIA171615_64LR_DP_1SRC:
 	case ENC_AUTIA1716_HI_HINTS:
 	case ENC_AUTIASP_HI_HINTS:
 	case ENC_AUTIAZ_HI_HINTS:
+	case ENC_AUTIB171615_64LR_DP_1SRC:
 	case ENC_AUTIB1716_HI_HINTS:
 	case ENC_AUTIBSP_HI_HINTS:
 	case ENC_AUTIBZ_HI_HINTS:
@@ -1591,12 +1593,19 @@ int decode_scratchpad(context* ctx, Instruction* instr)
 	case ENC_ERET_64E_BRANCH_REG:
 	case ENC_ESB_HI_HINTS:
 	case ENC_NOP_HI_HINTS:
+	case ENC_PACIA171615_64LR_DP_1SRC:
 	case ENC_PACIA1716_HI_HINTS:
 	case ENC_PACIASP_HI_HINTS:
+	case ENC_PACIASPPC_64LR_DP_1SRC:
 	case ENC_PACIAZ_HI_HINTS:
+	case ENC_PACIB171615_64LR_DP_1SRC:
 	case ENC_PACIB1716_HI_HINTS:
 	case ENC_PACIBSP_HI_HINTS:
+	case ENC_PACIBSPPC_64LR_DP_1SRC:
 	case ENC_PACIBZ_HI_HINTS:
+	case ENC_PACM_HI_HINTS:
+	case ENC_PACNBIASPPC_64LR_DP_1SRC:
+	case ENC_PACNBIBSPPC_64LR_DP_1SRC:
 	case ENC_RETAA_64E_BRANCH_REG:
 	case ENC_RETAB_64E_BRANCH_REG:
 	case ENC_SEVL_HI_HINTS:
@@ -6037,6 +6046,8 @@ int decode_scratchpad(context* ctx, Instruction* instr)
 		}
 		break;
 	}
+	case ENC_AUTIASPPCR_64LRR_DP_1SRC:
+	case ENC_AUTIBSPPCR_64LRR_DP_1SRC:
 	case ENC_BLRAAZ_64_BRANCH_REG:
 	case ENC_BLRABZ_64_BRANCH_REG:
 	case ENC_BLR_64_BRANCH_REG:
@@ -7770,6 +7781,24 @@ int decode_scratchpad(context* ctx, Instruction* instr)
 		ADD_OPERAND_LABEL;
 		break;
 	}
+	case ENC_RETAASPPCR_64M_BRANCH_REG:
+	case ENC_RETABSPPCR_64M_BRANCH_REG:
+	{
+		// <Xm>
+		ADD_OPERAND_XM;
+		break;
+	}
+	case ENC_AUTIASPPC_ONLY_DP_1SRC_IMM:
+	case ENC_AUTIBSPPC_ONLY_DP_1SRC_IMM:
+	case ENC_RETAASPPC_ONLY_MISCBRANCH:
+	case ENC_RETABSPPC_ONLY_MISCBRANCH:
+	{
+		/* these encode a negative offset: the modifier is PC minus <offset> */
+		uint64_t eaddr = ctx->address - ctx->offset;
+		// <label>
+		ADD_OPERAND_LABEL;
+		break;
+	}
 	case ENC_SYS_CR_SYSTEMINSTRS:
 	{
 		// sys #<op1>,<Cn>,<Cm>, #<op2>{,<Xt>}
diff --git a/arch/arm64/il.cpp b/arch/arm64/il.cpp
index 710ca55fe5..116d2b134d 100644
--- a/arch/arm64/il.cpp
+++ b/arch/arm64/il.cpp
@@ -1263,6 +1263,14 @@ enum Arm64Intrinsic operation_to_intrinsic(int operation)
 	case ARM64_AUTIBZ:
 	case ARM64_AUTIZB:
 		return ARM64_INTRIN_AUTIB;
+	case ARM64_AUTIA171615:
+	case ARM64_AUTIASPPC:
+	case ARM64_AUTIASPPCR:
+		return ARM64_INTRIN_AUTIA2;
+	case ARM64_AUTIB171615:
+	case ARM64_AUTIBSPPC:
+	case ARM64_AUTIBSPPCR:
+		return ARM64_INTRIN_AUTIB2;
 	case ARM64_PACDA:
 	case ARM64_PACDZA:
 		return ARM64_INTRIN_PACDA;
@@ -1283,6 +1291,14 @@ enum Arm64Intrinsic operation_to_intrinsic(int operation)
 	case ARM64_PACIBZ:
 	case ARM64_PACIZB:
 		return ARM64_INTRIN_PACIB;
+	case ARM64_PACIA171615:
+	case ARM64_PACIASPPC:
+	case ARM64_PACNBIASPPC:
+		return ARM64_INTRIN_PACIA2;
+	case ARM64_PACIB171615:
+	case ARM64_PACIBSPPC:
+	case ARM64_PACNBIBSPPC:
+		return ARM64_INTRIN_PACIB2;
 	case ARM64_XPACD:
 		return ARM64_INTRIN_XPACD;
 	case ARM64_XPACI:
@@ -3065,6 +3081,38 @@ bool GetLowLevelILForInstruction(
 		il.AddInstruction(il.Intrinsic({RegisterOrFlag::Register(REG_X30)},
 		    operation_to_intrinsic(instr.operation), {il.Register(8, REG_X30), il.Register(8, REG_SP)}));
 		break;
+	case ARM64_AUTIA171615:
+	case ARM64_AUTIB171615:
+	case ARM64_PACIA171615:
+	case ARM64_PACIB171615:
+		// x17 is address, x16 and x15 are the modifiers
+		il.AddInstruction(il.Intrinsic({RegisterOrFlag::Register(REG_X17)},
+		    operation_to_intrinsic(instr.operation),
+		    {il.Register(8, REG_X17), il.Register(8, REG_X16), il.Register(8, REG_X15)}));
+		break;
+	case ARM64_PACIASPPC:
+	case ARM64_PACIBSPPC:
+	case ARM64_PACNBIASPPC:
+	case ARM64_PACNBIBSPPC:
+		// x30 is address, sp and this instruction's own address are the modifiers
+		il.AddInstruction(il.Intrinsic({RegisterOrFlag::Register(REG_X30)},
+		    operation_to_intrinsic(instr.operation),
+		    {il.Register(8, REG_X30), il.Register(8, REG_SP), il.ConstPointer(addrSize, addr)}));
+		break;
+	case ARM64_AUTIASPPCR:
+	case ARM64_AUTIBSPPCR:
+		// x30 is address, sp and <Xn> are the modifiers
+		il.AddInstruction(il.Intrinsic({RegisterOrFlag::Register(REG_X30)},
+		    operation_to_intrinsic(instr.operation),
+		    {il.Register(8, REG_X30), il.Register(8, REG_SP), ILREG_O(operand1)}));
+		break;
+	case ARM64_AUTIASPPC:
+	case ARM64_AUTIBSPPC:
+		// x30 is address, sp and <label> (already resolved to pc-offset by the decoder) are the modifiers
+		il.AddInstruction(il.Intrinsic({RegisterOrFlag::Register(REG_X30)},
+		    operation_to_intrinsic(instr.operation),
+		    {il.Register(8, REG_X30), il.Register(8, REG_SP), il.ConstPointer(addrSize, IMM_O(operand1))}));
+		break;
 #else
 	case ARM64_AUTDA:
 	case ARM64_AUTDB:
@@ -3098,6 +3146,18 @@ bool GetLowLevelILForInstruction(
 	case ARM64_AUTIBSP:
 	case ARM64_PACIASP:
 	case ARM64_PACIBSP:
+	case ARM64_AUTIA171615:
+	case ARM64_AUTIB171615:
+	case ARM64_PACIA171615:
+	case ARM64_PACIB171615:
+	case ARM64_AUTIASPPC:
+	case ARM64_AUTIBSPPC:
+	case ARM64_AUTIASPPCR:
+	case ARM64_AUTIBSPPCR:
+	case ARM64_PACIASPPC:
+	case ARM64_PACIBSPPC:
+	case ARM64_PACNBIASPPC:
+	case ARM64_PACNBIBSPPC:
 		il.AddInstruction(il.Nop());
 		ApplyAttributeToLastInstruction(il, SrcInstructionUsesPointerAuth);
 		break;
@@ -3160,6 +3220,15 @@ bool GetLowLevelILForInstruction(
 	case ARM64_PSB:
 		il.AddInstruction(il.Intrinsic({}, ARM64_INTRIN_PSBCSYNC, {}));
 		break;
+	case ARM64_RETAASPPC:
+	case ARM64_RETABSPPC:
+	case ARM64_RETAASPPCR:
+	case ARM64_RETABSPPCR:
+		// Unlike RET, the operand here is an authentication modifier. These always
+		// return to x30.
+		il.AddInstruction(il.Return(il.Register(8, REG_X30)));
+		ApplyAttributeToLastInstruction(il, SrcInstructionUsesPointerAuth);
+		break;
 	case ARM64_RETAA:
 	case ARM64_RETAB:
 		SetPacAttr = true;
@@ -4167,6 +4236,9 @@ bool GetLowLevelILForInstruction(
 	case ARM64_CSDB:
 		il.AddInstruction(il.Intrinsic({}, ARM64_INTRIN_HINT_CSDB, {}));
 		break;
+	case ARM64_PACM:
+		il.AddInstruction(il.Intrinsic({}, ARM64_INTRIN_HINT_PACM, {}));
+		break;
 	case ARM64_HINT:
 		if ((IMM_O(operand1) & ~0b110) == 0b100000)
 			il.AddInstruction(il.Intrinsic({}, ARM64_INTRIN_HINT_BTI, {}));
diff --git a/arch/arm64/il.h b/arch/arm64/il.h
index 1e1823186d..3ee54f063c 100644
--- a/arch/arm64/il.h
+++ b/arch/arm64/il.h
@@ -112,6 +112,12 @@ enum Arm64Intrinsic : uint32_t
 	ARM64_INTRIN_SUBG,
 	ARM64_INTRIN_SUBP,
 	ARM64_INTRIN_SUBPS,
+	/* FEAT_PAuth_LR: sign/authenticate against two modifiers (AddPAC*2 / Auth*2) */
+	ARM64_INTRIN_HINT_PACM,
+	ARM64_INTRIN_AUTIA2,
+	ARM64_INTRIN_AUTIB2,
+	ARM64_INTRIN_PACIA2,
+	ARM64_INTRIN_PACIB2,
 	ARM64_INTRIN_NORMAL_END, /* needed so intrinsics can be extended by other lists, like neon
 	                            intrinsics */
 	ARM64_INTRIN_INVALID = 0xFFFFFFFF,