x86 and x64: bug in push argument size

bdcht / amoco

yet another tool for analysing binaries

GNU General Public License v2.0

462 stars 65 forks source link

x86 and x64: bug in push argument size #62

Closed LRGH closed 8 years ago

LRGH commented 8 years ago

>>> cpu_x86.disassemble('\x66\x6a\x08').operands[0].size
8
>>> cpu_x64.disassemble('\x66\x6a\x08').operands[0].size
8

Should be 16.

The Intel manual recommends that 0x66 0x68 N N is used for 16-bit push, but GNU as (at least version 2.25) generates 0x66 0x6A 0x08 when asked to assemble pushw $8.

LRGH commented 8 years ago

I have checked and on my CPU (Core i7) this instruction is a 16-bit push. esp is decreased by two. I have added the corresponding patch to my pull request.