Closed hksoobe closed 5 years ago
Hello there, No this's not a bug: the opcode 0xA1 defines the following instruction : MOV rAX,Ov The "O" is an offset ! some disassembler stringify it as memory and some of them as immediate (like UnivDisasm). There is an option USO_OFFSET_AS_MEM to make UnivDisasm stringify offset as memory. Here is an example :
const
LArray: array [0 .. 9] of Byte = ($48, $A1, $88, $88, $88, $88, $77, $77, $77, $77);
var
ins: TInstruction;
P: PByte;
begin
P := @LArray[0];
ins := default (TInstruction);
ins.Arch := CPUX64;
ins.Addr := P;
ins.SyntaxOptions := USO_OFFSET_AS_MEM; // stringify offset as memory.
Disasm(@ins);
Writeln(ins.inststr); // output = mov rax,[0x7777777788888888]
ReadLn;
end.
thank you
db $48, $A1, $88, $88, $88, $88, $77, $77, $77, $77 Delphi Show mov rax,[qword $7777777788888888]
x64dbg show movabs rax, qword ptr [0x7777777788888888]
UnivDisasm show Missing[] mov rax,0x7777777788888888