@Test
	public void testSelfModifyingX86() throws Throwable {
		try (ToyDBTraceBuilder tb = new ToyDBTraceBuilder("Test", "x86:LE:64:default")) {
			// NB. Assembly actually happens first, so Sleigh will modify it
			TraceThread thread = initTrace(tb, """
					RIP = 0x00400000;
					RSP = 0x00110000;
					RAX = 0x12345678;
					*:1 0x00400007:8 = *0x00400007:8 ^ 0xcc;
					""",
				List.of(
					// First instruction undoes the modification above
					"XOR byte ptr [0x00400007], 0xcc",  // 7 bytes
					"MOV EAX,0x0dedbeef"));            // 5 bytes

			BytesTracePcodeEmulator emu = new BytesTracePcodeEmulator(tb.host, 0);
			PcodeThread<byte[]> emuThread = emu.newThread(thread.getPath());

			emuThread.stepInstruction();
			emuThread.stepInstruction();

			try (Transaction tx = tb.startTransaction()) {
				emu.writeDown(tb.host, 1, 1);
			}

			assertEquals(BigInteger.valueOf(0x00110000),
				TraceSleighUtils.evaluate("RSP", tb.trace, 1, thread, 0));
			assertEquals(BigInteger.valueOf(0x0040000c),
				TraceSleighUtils.evaluate("RIP", tb.trace, 1, thread, 0));
			assertEquals(BigInteger.valueOf(0x0dedbeefL),
				TraceSleighUtils.evaluate("RAX", tb.trace, 1, thread, 0));
		}
	}
Test the instruction decoder considers the cached state

<p>
This may not reflect the semantics of an actual processor in these situations, since they may
have instruction caching. Emulating such semantics is TODO, if at all. NB. This also tests
that PC-relative addressing works, since internally the emulator advances the counter after
execution of each instruction. Addressing is computed by the Sleigh instruction parser and
encoded as a constant deref in the p-code.
Ghidra/Debug/Framework-TraceModeling/src/test/java/ghidra/pcode/exec/trace/BytesTracePcodeEmulatorTest.java