0

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW.

Here is the machine code:

0x48, 0x8D, 0x0D, 0xED, 0x44, 0x01, 0x00

In IDA/HIEW the disassembly is:

lea  rcx,[0000148F8]

But by using Capstone (with PowerShell bindings) I get different address 0x144ed:

Get-CapstoneDisassembly -Architecture CS_ARCH_X86 -Mode CS_MODE_64 -Bytes (
    0x48, 0x8D, 0x0D, 0xED, 0x44, 0x01, 0x00
) -Address 0x1800000004096 -Detailed

Size     : 7
Address  : 0x180001000
Mnemonic : lea
Operands : rcx, qword ptr [rip + 0x144ed]
Bytes    : {72, 141, 13, 237, 68, 1, 0, 148, 204, 148, 0, 17, 0, 128, 0, 0}
RegRead  :
RegWrite :

You can verify this online by using Capstone.js and 488D0DED440100 as input.

I've also tried SharpDisasm, but result is the same:

lea rcx, [rip+0x144ed]

Could somebody help me to understand what's happening here?

3

This is RIP-relative addressing. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = rip + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that instruction is located at 0x404 so it is adding 0x144ed to (0x404+7) = 0x148f8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.