capstone icon indicating copy to clipboard operation
capstone copied to clipboard

x86_64 dissassembly relative_branch returned inversely

Open r0c300 opened this issue 2 years ago • 1 comments

When disassembling jumps and branches for x86 code (64-bit mode) the instruction group type 'branch_relative' is returned for absolute branches, and not for relative branches.

I tried Rust bindings and direct C code and both yield the same results.

For example to disassemble this I receive no 'branch_relative' group type using the example code from the site to list the details of the instruction: 0x1000: call qword ptr [rip + 0x2f73] // insn-mnem: call Implicit registers read: rsp This instruction belongs to groups: 2 145

Afaik, branch_relative is group 7 or so, not included here.

When I dissassemble the opcodes for an absolute branch with the same code, it does give me group 7.

0x1000: call 0x2105 // insn-mnem: call Implicit registers read: rsp rip This instruction belongs to groups: 2 7 145

r0c300 avatar May 10 '22 13:05 r0c300

example code (basically from the website) https://gist.github.com/r0c300/07548c3198732b1f58105427ca14f323

used following instructions approximately to test: "\xe8\x00\x11\x00\x00" call 0x1105 "\xff\x15\xf3\x12\x00\x00" call QWORD PTR [rip+0x12f3]

r0c300 avatar May 10 '22 13:05 r0c300