capstone
capstone copied to clipboard
x86_64 dissassembly relative_branch returned inversely
When disassembling jumps and branches for x86 code (64-bit mode) the instruction group type 'branch_relative' is returned for absolute branches, and not for relative branches.
I tried Rust bindings and direct C code and both yield the same results.
For example to disassemble this I receive no 'branch_relative' group type using the example code from the site to list the details of the instruction: 0x1000: call qword ptr [rip + 0x2f73] // insn-mnem: call Implicit registers read: rsp This instruction belongs to groups: 2 145
Afaik, branch_relative is group 7 or so, not included here.
When I dissassemble the opcodes for an absolute branch with the same code, it does give me group 7.
0x1000: call 0x2105 // insn-mnem: call Implicit registers read: rsp rip This instruction belongs to groups: 2 7 145
example code (basically from the website) https://gist.github.com/r0c300/07548c3198732b1f58105427ca14f323
used following instructions approximately to test: "\xe8\x00\x11\x00\x00" call 0x1105 "\xff\x15\xf3\x12\x00\x00" call QWORD PTR [rip+0x12f3]