Open j123123 opened 8 years ago
but it works with [rsp+rax]
would you mind sending in a testcase for this issue, like those under https://github.com/keystone-engine/keystone/tree/master/suite/regress?
I'm not very familiar with python. I can provide this example (terminal session):
$ cat sample.py
#!/usr/bin/env python
from __future__ import print_function
from keystone import *
def test_ks(arch, mode, code, syntax=0):
ks = Ks(arch, mode)
if syntax != 0:
ks.syntax = syntax
encoding, count = ks.asm(code)
print("%s = [ " % code, end='')
for i in encoding:
print("%02x " % i, end='')
print("]")
if __name__ == '__main__':
# X86
test_ks(KS_ARCH_X86, KS_MODE_64, b"mov [rax+rsp], rsi")
test_ks(KS_ARCH_X86, KS_MODE_64, b"mov [rsp+rax], rsi")
$ python sample.py
mov [rax+rsp], rsi = [ 48 89 34 20 ]
mov [rsp+rax], rsi = [ 48 89 34 04 ]
$ rasm2 -a x86 -s intel -b 64 -d '48 89 34 20'
mov qword [rax], rsi
$ rasm2 -a x86 -s intel -b 64 -d '48 89 34 04'
mov qword [rsp + rax], rsi
Here I get invalid output when using python binding. rasm2
here uses capstone to disasm output from keystone
Testcase rasm2 from radare2