Skip to content

[x86] wrong displacement offset in mov instruction (next branch) #1560

@aeflores

Description

@aeflores

The instruction is: 0x48 0xc7 0x04 0x24 0x78 0x14 0x65 0x00
which decodes to mov qword ptr [rsp], 0x651478 using cstool is not completely well decoded in the next branch.

Using tests/test_x86 in master you get the correct

0x1000:	mov	qword ptr [rsp], 0x651478
	Prefix:0x00 0x00 0x00 0x00 
	Opcode:0xc7 0x00 0x00 0x00 
	rex: 0x48
	addr_size: 8
	modrm: 0x4
	modrm_offset: 0x2
	disp: 0x0
	sib: 0x24
		sib_base: rsp
		sib_scale: 1
	imm_count: 1
		imms[1]: 0x651478
	imm_offset: 0x4
	imm_size: 0x4
	op_count: 2
		operands[0].type: MEM
			operands[0].mem.base: REG = rsp
		operands[0].size: 8
		operands[0].access: WRITE
		operands[1].type: IMM = 0x651478
		operands[1].size: 8
	Registers read: rsp

Where disp has no size or offset.
But in the next branch you get an incorrect disp offset of 4 equal to the imm disp:

0x1000:	mov	qword ptr [rsp], 0x651478
	Prefix:0x00 0x00 0x00 0x00 
	Opcode:0xc7 0x00 0x00 0x00 
	rex: 0x48
	addr_size: 8
	modrm: 0x4
	modrm_offset: 0x2
	disp: 0x0
	disp_offset: 0x4
	disp_size: 0x4
	sib: 0x24
		sib_base: rsp
		sib_scale: 1
	imm_count: 1
		imms[1]: 0x651478
	imm_offset: 0x4
	imm_size: 0x4
	op_count: 2
		operands[0].type: MEM
			operands[0].mem.base: REG = rsp
		operands[0].size: 8
		operands[0].access: WRITE
		operands[1].type: IMM = 0x651478
		operands[1].size: 8
	Registers read: rsp

If I wanted to fix this myself, where would I look?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions