Closed GoogleCodeExporter closed 9 years ago
I don't know what you're trying to disassemble. But you have two prefixes here!
So the second one overrides the first one. Then the instruction starts with
0x3d, which is really a 'compare'. And then you're not passing enough bytes so
you get the instruction broken.
I don't know what disassembler you use, but even WinDbg gave me the following
output for your input:
0 48 ???
1 4b3d534c5fcc cmp rax,0FFFFFFFFCC5F4C53h
So if you're adding another byte to the stream, diStorm will give you a good
result.
Good luck.
Original comment by distorm@gmail.com
on 6 Nov 2010 at 6:17
I was disassembling it with PEBrowsePro, which must automatically pad with
zeros because if I change the bytes to '488b3d534c5f00', as you suggest, it
matches what PEBrowsePro gives..
Sorry.
Original comment by jcope...@gmail.com
on 7 Nov 2010 at 3:54
Original issue reported on code.google.com by
jcope...@gmail.com
on 5 Nov 2010 at 7:45