Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

a bug report #10

Closed
hksoobe opened this issue May 4, 2016 · 5 comments
Closed

a bug report #10

hksoobe opened this issue May 4, 2016 · 5 comments

Comments

@hksoobe
Copy link

hksoobe commented May 4, 2016

used UnivDisasm-master\GUI\ [1]. is right, [2]. is wrong
[1]. 8B 0D 00 02 46 00 mov ecx,dword ds:[0x00460200] // this is Right

[2]. A1 14 01 46 00 mov eax, ds:0x0046014 //this is error
This should mov eax, dword ds:[0x0046014]

@MahdiSafsafi
Copy link
Owner

Hi hksoobe,
[2] is correct ! This instruction uses offset instead of ModRm to access memory location... UnivDisasm differs between OFFSET and LEGACY_MEMORY address.
From Intel documentation:
mov
Disassembling the same instruction using onlinedisassembler.com gives the same result as UnivDisasm.
Please for more information refer to Intel documentation.

@hksoobe
Copy link
Author

hksoobe commented May 5, 2016

I don't know why you're differentiate them
They work exactly the same

They show the same in OllyDBG. For example OllyDBG:
od

They show the same in Delphi XE. For example Delphi XE:
image

They show the same in IDA. For example IDA:
image

They are all unified display format
If you have to distinguish, I think you can provide an option

@MahdiSafsafi
Copy link
Owner

Hi hksoobe,
Thank you for your reply. The reason why I'am distinguishing them is that UnivDisasm follows Intel syntax ! If Intel syntax distinguished this instructions, UnivDisasm must do the same.
In addition, UnivDisasm is a customisable disasm that means you can easy register your own syntax decoder (By doing that you can make all this instructions look the same so they appear like : mov reg,size[address]). I can't provide an option to disable them ... The only way is to register a new SyntaxDecoder (Please see "UnivDisasm.SyntaxManager.pas" and "UnivDisasm.Syntax.UnivSyntax.pas").

Reagrds,
Mahdi.

MahdiSafsafi added a commit that referenced this issue May 5, 2016
Added USO_OFFSET_AS_MEM option.
Fix #10
Fix #11
MahdiSafsafi added a commit that referenced this issue May 5, 2016
Added USO_OFFSET_AS_MEM option.
Fix #10
Fix #11
@MahdiSafsafi
Copy link
Owner

Please check the latest commit, I included an update to provide a support for this request.
Now, you can just include USO_OFFSET_AS_MEM option in SyntaxOptions and UnivDisasm will not make difference between offset and memory.
So : A1 14 01 46 00 mov eax, ds:0x0046014 will become A1 14 01 46 00 mov eax,dword ptr ds:[0x00460114]

@hksoobe
Copy link
Author

hksoobe commented May 5, 2016

thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants