search

justinstenning / SharpDisasm

SharpDisasm - x86 / x86-64 disassembler for .NET
https://www.nuget.org/packages/SharpDisasm
Other
212 stars 39 forks source link

[64bit] fix popfw and truncated address in conditional jump instructions #14

Closed Fonger closed 6 years ago

Fonger commented 6 years ago

This fix a critical translation error that conditional jump addresses get truncated. udis86 should update the opcode definition file too ( see vmt/udis86#126 vmt/udis86#128 )

also, popfw is correctly resolved in 64bit mode now ( see vmt/udis86#101 )

It seems that vmt doesn't maintain udis86 anymore for years. We have to fix that ourself.

before patch

00007ff71c0b247b 41 81 f8 00 08 00 00           cmp r8d, 0x800
00007ff71c0b2482 75 18                          jnz 0x1c0b249c
00007ff71c0b2484 66 9c                          pushfw
00007ff71c0b2486 66 9d                          o16 invalid

after patch

00007ff71c0b247b 41 81 f8 00 08 00 00           cmp r8d, 0x800
00007ff71c0b2482 75 18                          jnz 0x7ff711c0b249c
00007ff71c0b2484 66 9c                          pushfw
00007ff71c0b2486 66 9d                          popfw