keystone icon indicating copy to clipboard operation
keystone copied to clipboard

64 bit inc not throwing error

Open timwoocker opened this issue 4 years ago • 0 comments

The 64 bit address gets cut off resulting in wrong bytecode. Here is an example of what's happening:

>>> ks = keystone.Ks(keystone.KS_ARCH_X86, keystone.KS_MODE_64)
>>> ks.asm("inc	dword ptr [0x1456b56dc]", 0xc19b0023, True)
(b'\xff\x04%\xdcVkE', 1)
>>> cs = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)
>>> next(cs.disasm(b'\xff\x04%\xdcVkE', 0xc19b0023))
<CsInsn 0xc19b0023 [ff0425dc566b45]: inc dword ptr [0x456b56dc]>

As you can see the 1 from the pointer addr gets cut off leaving just the 32 bit value. Apparently using inc over such a far distance isn't possible in 64 bit so this should just throw an error.

This is def a bug in keystone and not the capstone disasm -> I tested the results in several disassemblers.

timwoocker avatar Aug 16 '21 09:08 timwoocker