capstone
capstone copied to clipboard
Printers ignore HEX_THRESHOLD for negative values
Work environment
| Questions | Answers |
|---|---|
| System Capstone runs on OS/arch/bits | Fedora 41 x86_64 |
| Capstone module affected | x86 |
| Source of Capstone | Fedora package |
| Version/git commit | 5.0.1-6.fc41 |
Instruction bytes giving faulty results
0x48,0xb8,0xff,0xff,0xff,0xff,0xff,0xf3,0xff,0xff
Expected results
It should be:
movabsq $0xfffff3ffffffffff, %rax
But I got:
movabsq $18446730879570018303, %rax
The immediate value is represented as decimal instead of hexadecimal.
This seems to have changed in capstone 5.x, as 4.x displays the expect result. This is not really an incorrect result, but the fact that different capstone versions yield different results is inconvenient.
Steps to get the wrong result
$ cstool x64att 0x48,0xb8,0xff,0xff,0xff,0xff,0xff,0xf3,0xff,0xff
0 48 b8 ff ff ff ff ff f3 ff ff movabsq $18446730879570018303, %rax
Seems to be specific to x86 (but likely some other none Auto-Sync archs).
Because the printer doesn't use the printInt... functions from SStream.c:
https://github.com/capstone-engine/capstone/blob/5058c6342e42d52f35b79dd95f4a19f99b7c479b/arch/X86/X86ATTInstPrinter.c#L267-L279