Incorrectly reading sub rsp

Open dominictobias opened this issue 10 years ago • 0 comments

Hi, @TrevorSundberg noticed this issue:

https://github.com/DominicTobias/detourxs/issues/1

LDE is reading the following as a 5 byte instruction (48 83 EC 38 48):

48 83 EC 38          sub         rsp,38h
48 8B 44 24 68       mov        rax,qword ptr [rsp+68h]

I last updated the LDE lib many years ago, do you know if this was fixed? Maybe I can get hold of a newer version if so. If not I'll just monkey patch it as the OP suggests.

Thanks!

Dec 01 '15 10:12 dominictobias