search

eteran / edb-debugger

edb is a cross-platform AArch32/x86/x86-64 debugger.
GNU General Public License v2.0
2.7k stars 326 forks source link

Decode REG+REG*X as REG*(X+1) #678

Closed AaronOpfer closed 5 years ago

AaronOpfer commented 6 years ago

The instruction MOVZX EAX, [RAX+RAX*4+0x5CFEA60] appeared in an application I was debugging and, while I understand the instruction's bytecode translates literally to this instruction, I think it would make sense to instead represent this as MOVZX EAX, [RAX*5+0x5CFEA60].

10110111 commented 6 years ago

Might be better to first try asking for this at Capstone's issue tracker. If they refuse, then we'll have to add one more tweak of the disassembly.

eteran commented 6 years ago

I agree, that this is a capstone "issue". And I use the word issue lightly because capstone is technically doing the right thing and what you suggest is merely a visual simplification.

eteran commented 5 years ago

I'm going to close this. Not because I disagree, but because it really is a capstone enhancement. We could do this at an edb level, but it would be messy and special-casing which tends to lead to brittle code in the long run. This is better-handled int he disassembler itself.