I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the
from capstone import * from capstone.x86 import * md = Cs(CS_ARCH_X86, CS_MODE_64) md.detail = True #instruction_bytes = b'b\x11\r(\xfe\xf6' # The above instruction_bytes work as expected, the below print shows # 0x6: vpaddd ymm14 , ymm14, ymm30 62110d28fef6 instruction_bytes = b'b\xf3}(C\xe4\x03' # Capstone has problem with the above instruction_bytes. # IDA Pro shows the instruction vshufi32x4 ymm4, ymm0, ymm4, 3 print(instruction_bytes.hex()) # '62f37d2843e403' for c_i in md.disasm(instruction_bytes, len(instruction_bytes)): print(hex(c_i.address) + ":", c_i.mnemonic, c_i.op_str, "\t\t\t\t", c_i.bytes.hex())
Other examples which cannot be disassembled by Capstone are
What is so special about these instructions? How can I make Capstone disassemble them?