Bug report: x86 disassembly doesn't correctly handle REX prefixes in 64 bit mode
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the bug**
64-bit REX register prefixes (at least) are not correctly disassembled; see reproduction case, which is outputting the wrong register. I haven't done further testing to identify what specific cases are wrong beyond this.
**To Reproduce**
https://gchq.github.io/CyberChef/#recipe=Disassemble_x86('64','Full%20x86%20architecture',16,0,true,true)&input=NDhCQTEyMzQ1Njc4MTEyMjMzNDQKNDlCQTEyMzQ1Njc4MTEyMjMzNDQ
Output:
```
0000000000000000 48BA1234567811223344 MOV RDX,4433221178563412
000000000000000A 49BA1234567811223344 MOV RDX,4433221178563412
```
**Expected behaviour**
Output should be:
```
0000000000000000 48BA1234567811223344 MOV RDX,4433221178563412
000000000000000A 49BA1234567811223344 MOV R10,4433221178563412
```
Note the register difference on the second line vs the actual output.
**Desktop (if relevant, please complete the following information):**
- OS: macOS
- Browser: Chrome 84
- CyberChef version: latest
Contributor guide
Assessment
This issue has not been assessed yet.