vmt / udis86

Disassembler Library for x86 and x86-64
http://udis86.sourceforge.net
BSD 2-Clause "Simplified" License
1.02k stars 299 forks source link

x64 mode 066h & REX.W bug? #83

Open DrGolova opened 10 years ago

DrGolova commented 10 years ago

Hello,

UDIs86 v1.7.2 in 64-bit mode disassemble "66 48 68 01 23 45 67" sequence as 5-bytes long "push 2301h" instruction. But it must be 7-bytes long "push 067452301h" (REX.W bit must supersede 066h data-size override prefix).

Actually UDis86 just lose REX.W in resolve_mode() due to invalid flags in u->itab_entry->prefix for 068h opcode and fall into invalid 16-bit mode disassembling. Quick bruteforcing also shows such issue for 0E8h & 0E9h opcodes (I checked only 1-byte opcodes and only for 066h & REX.W mixing).