Skip to content

x64 jump instructions have eip as modified register #2691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OBarronCS opened this issue Apr 23, 2025 · 0 comments
Open

x64 jump instructions have eip as modified register #2691

OBarronCS opened this issue Apr 23, 2025 · 0 comments
Labels
bug Something is not working as it should X86 Arch

Comments

@OBarronCS
Copy link

Questions Answers
Capstone module affected x64
Source of Capstone pip install capstone==6.0.0a4
Version/git commit 6.0.0 alpha 4

Upon disassembling different jump instructions in x64 mode, I saw that the "registers written" value have eip as the register modified, instead of rip.

Actual behavior

cstool -d x64 "e9 d0 ff ff ff"
 0  e9 d0 ff ff ff                                   jmp	0xffffffffffffffd5
	ID: 172 (jmp)
	Prefix:0x00 0x00 0x00 0x00 
	Opcode:0xe9 0x00 0x00 0x00 
	rex: 0x0
	addr_size: 8
	modrm: 0x0
	disp: 0x0
	sib: 0x0
	imm_count: 1
		imms[1]: 0xffffffffffffffd5
	op_count: 1
		operands[0].type: IMM = 0xffffffffffffffd5
		operands[0].size: 8
	Registers modified: eip
	Groups: branch_relative jump 

The same is true for je,ja,jle,jbe, etc.

Expected behavior

Register write is rip, not eip

@Rot127 Rot127 added bug Something is not working as it should X86 Arch labels Apr 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something is not working as it should X86 Arch
Projects
None yet
Development

No branches or pull requests

2 participants