Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PUSH on amd64 #85

Open
GoogleCodeExporter opened this issue Apr 20, 2015 · 0 comments
Open

PUSH on amd64 #85

GoogleCodeExporter opened this issue Apr 20, 2015 · 0 comments

Comments

@GoogleCodeExporter
Copy link

In what mode did you try to disassemble (16/32/64)?
64

What is the input buffer (binary stream) you used to reproduce the problem?
6802000000

What is the expected output (or what instruction)?
PUSH QWORD 0x2

Which tool did you use to see the expected output?

# python
Python 2.7.9 (default, Feb  9 2015, 19:46:45) 
[GCC 4.8.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import distorm3
>>> str(distorm3.Decompose(0x4004c6, '6802000000'.decode('hex'), 
2)[0].operands[0].size)
'32'
>>> str(distorm3.Decompose(0x4004c6, '6802000000'.decode('hex'), 2)[0])
'PUSH DWORD 0x2'


What do you see instead?
'PUSH DWORD 0x2'

What version of diStorm are you using? On what platform (Python/EXE/other)?
distorm3-3.3.0-py2.7.egg-info

Please provide any additional information below.
Okay I know the immediate is a 32 bit value encoded in the intruction. But How 
do I know how much to actually push? 
Objdump shows a "pushq"
   0x4004c6 <__libc_start_main@plt+6>:  pushq  $0x2





Original issue reported on code.google.com by felipe.a...@gmail.com on 27 Feb 2015 at 10:35

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant