gchq / gchq/CyberChef

Bug report: x86 disassembly doesn't correctly handle REX prefixes in 64 bit mode

Open
#1,111 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Describe the bug**
64-bit REX register prefixes (at least) are not correctly disassembled; see reproduction case, which is outputting the wrong register. I haven't done further testing to identify what specific cases are wrong beyond this.

**To Reproduce**
https://gchq.github.io/CyberChef/#recipe=Disassemble_x86('64','Full%20x86%20architecture',16,0,true,true)&input=NDhCQTEyMzQ1Njc4MTEyMjMzNDQKNDlCQTEyMzQ1Njc4MTEyMjMzNDQ

Output:
```
0000000000000000 48BA1234567811223344 MOV RDX,4433221178563412
000000000000000A 49BA1234567811223344 MOV RDX,4433221178563412
```

**Expected behaviour**
Output should be:
```
0000000000000000 48BA1234567811223344 MOV RDX,4433221178563412
000000000000000A 49BA1234567811223344 MOV R10,4433221178563412
```

Note the register difference on the second line vs the actual output.

**Desktop (if relevant, please complete the following information):**
- OS: macOS
- Browser: Chrome 84
- CyberChef version: latest

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.