search

gdabah / distorm

Powerful Disassembler Library For x86/AMD64
Other
1.26k stars 238 forks source link

PUSH on amd64 #85

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 9 years ago 
In what mode did you try to disassemble (16/32/64)?
64

What is the input buffer (binary stream) you used to reproduce the problem?
6802000000

What is the expected output (or what instruction)?
PUSH QWORD 0x2

Which tool did you use to see the expected output?

# python
Python 2.7.9 (default, Feb  9 2015, 19:46:45) 
[GCC 4.8.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import distorm3
>>> str(distorm3.Decompose(0x4004c6, '6802000000'.decode('hex'), 
2)[0].operands[0].size)
'32'
>>> str(distorm3.Decompose(0x4004c6, '6802000000'.decode('hex'), 2)[0])
'PUSH DWORD 0x2'

What do you see instead?
'PUSH DWORD 0x2'

What version of diStorm are you using? On what platform (Python/EXE/other)?
distorm3-3.3.0-py2.7.egg-info

Please provide any additional information below.
Okay I know the immediate is a 32 bit value encoded in the intruction. But How 
do I know how much to actually push? 
Objdump shows a "pushq"
   0x4004c6 <__libc_start_main@plt+6>:  pushq  $0x2

Original issue reported on code.google.com by felipe.a...@gmail.com on 27 Feb 2015 at 10:35

gdabah commented 8 years ago

You just can't push an immediate 64 bits in x64. However, if the decoding mode you are using is 64, you should know that and act accordingly. In case there was an opsize prefix, then you can read it from the prefixes, etc... You have all the information to know the size of immediate and size of operation upon rSP.