nmd
nmd copied to clipboard
Fix disassembly of mov drX, reg
Was using it to handle some privileged instructions and it looks like the rex prefix isn't handled correctly. For some reason the disassembly text was correct, but the structure reported the wrong register.
The code I was using:
https://github.com/mrexodia/driver_unpacking/blob/4f2db064fabfc828549eba80d4b57ce80f0daa43/ntoskrnl/ntoskrnl.cpp#L111-L131