0

Given the opcode 80 3d 1d b0 09 00 00.

The corresponding capstone instruction is

<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>

and has the following properties (c_i being the name of the instruction object)

c_i.disp: 0x9b01d
c_i.disp_offset: 0x2
c_i.disp_size 0x4

A different instruction

<CsInsn 0xd3de [66c705714309000000]: mov word ptr [rip + 0x94371], 0> has:

c_i.disp:         0x94371
c_i.disp_offset:  0x3
c_i.disp_size:    0x2

The first two properties make sense to me. But why is the disp_size 0x2 and not 0x4?

1
  • I don't really know the answer, this might be it, but just pointing out the first is operating on byte and the second is word (2 byte)
    – mumbel
    Jul 16, 2022 at 23:02

1 Answer 1

2

This seems like a bug, there is an open issue in the Capstone repo that seems to fit: https://github.com/capstone-engine/capstone/issues/1640

2
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – sudhackar
    Jul 18, 2022 at 11:43
  • 1
    Sorry, I've edited to make it clear that I thought this was a bug. Jul 18, 2022 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.