You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Upon disassembling different jump instructions in x64 mode, I saw that the "registers written" value have eip as the register modified, instead of rip.
pip install capstone==6.0.0a4
Upon disassembling different jump instructions in x64 mode, I saw that the "registers written" value have
eip
as the register modified, instead ofrip
.Actual behavior
cstool -d x64 "e9 d0 ff ff ff" 0 e9 d0 ff ff ff jmp 0xffffffffffffffd5 ID: 172 (jmp) Prefix:0x00 0x00 0x00 0x00 Opcode:0xe9 0x00 0x00 0x00 rex: 0x0 addr_size: 8 modrm: 0x0 disp: 0x0 sib: 0x0 imm_count: 1 imms[1]: 0xffffffffffffffd5 op_count: 1 operands[0].type: IMM = 0xffffffffffffffd5 operands[0].size: 8 Registers modified: eip Groups: branch_relative jump
The same is true for
je
,ja
,jle
,jbe
, etc.Expected behavior
Register write is
rip
, noteip
The text was updated successfully, but these errors were encountered: