capstone
capstone copied to clipboard
Wrong disp_size with 0x66 prefix in x86 64bit
When there's a 0x66 prefix with rip-relative addressing instruction
the disp_size will be an incorrect value.
Some example:
from capstone import *
md = Cs(CS_ARCH_X86, CS_MODE_64)
md.detail = True
code = bytes.fromhex("66 89 3D 96 5A 0E 00")
ins = next(md.disasm(code, 0x140002523))
print(ins)
print('disp', hex(ins.disp))
print('disp_size', ins.disp_size)
code = bytes.fromhex("66 0F 6F 05 26 1C 0B 00")
ins = next(md.disasm(code, 0x140009C92))
print(ins)
print('disp', hex(ins.disp))
print('disp_size', ins.disp_size)
Output:
<CsInsn 0x140002523 [66893d965a0e00]: mov word ptr [rip + 0xe5a96], di>
disp 0xe5a96
disp_size 2
<CsInsn 0x140009c92 [660f6f05261c0b00]: movdqa xmm0, xmmword ptr [rip + 0xb1c26]>
disp 0xb1c26
disp_size 2
disp_size should be 4 instead of 2 here.
I ran into the same bug with this instruction:
<CsInsn 0xd3de [66c705714309000000]: mov word ptr [rip + 0x94371], 0> has:
c_i.disp: 0x94371
c_i.disp_offset: 0x3
c_i.disp_size: 0x2
Any plans to fix this? Or pointers how to fix it?