Displacement size (disp_size) of x86 instructions

Question

Given the opcode 80 3d 1d b0 09 00 00.

The corresponding capstone instruction is

<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>

and has the following properties (c_i being the name of the instruction object)

c_i.disp: 0x9b01d
c_i.disp_offset: 0x2
c_i.disp_size 0x4

A different instruction

<CsInsn 0xd3de [66c705714309000000]: mov word ptr [rip + 0x94371], 0> has:

c_i.disp:         0x94371
c_i.disp_offset:  0x3
c_i.disp_size:    0x2

The first two properties make sense to me. But why is the disp_size 0x2 and not 0x4?

I don't really know the answer, this might be it, but just pointing out the first is operating on byte and the second is word (2 byte) — mumbel, Commented Jul 16, 2022 at 23:02

Mega Tonnage · Accepted Answer · 2022-07-18 20:59:43Z

2

This seems like a bug, there is an open issue in the Capstone repo that seems to fit: https://github.com/capstone-engine/capstone/issues/1640

answered Jul 17, 2022 at 23:30

Mega Tonnage

7962 silver badges5 bronze badges

This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
– sudhackar
Commented Jul 18, 2022 at 11:43
1

Sorry, I've edited to make it clear that I thought this was a bug.
– Mega Tonnage
Commented Jul 18, 2022 at 21:00

Add a comment |

1 Answer 1