From db6ecf9b76a25c465887946fe70e74b3dcdce234 Mon Sep 17 00:00:00 2001 From: Mark Scott Date: Tue, 3 Nov 2015 23:09:05 +0300 Subject: [PATCH] disasm: Fix for disassembly of BOUND The opcode for BOUND, 62h, has a different meaning in long mode - it is the prefix for EVEX instructions. ndisasm did not take this into account and always tried to disassemble 62h back to an EVEX instruction. Attached patch only permits EVEX disassembly if bitness is 64. In 16/32 bit mode 62h will be not be a prefix and so disassemble to BOUND. Signed-off-by: Mark Scott Signed-off-by: Cyrill Gorcunov --- disasm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/disasm.c b/disasm.c index e7484830..da396326 100644 --- a/disasm.c +++ b/disasm.c @@ -1216,7 +1216,7 @@ int32_t disasm(uint8_t *data, char *output, int outbufsize, int segsize, case 0x62: { uint8_t evex_p0 = data[1] & 0x0f; - if (segsize == 64 || + if (segsize == 64 && ((evex_p0 >= 0x01) && (evex_p0 <= 0x03))) { data++; /* 62h EVEX prefix */ prefix.evex[0] = *data++; -- 2.11.4.GIT