This input:
bits 64
push qword 0xffff0000
Gives this disassembly:
$ ndisasm -b 64 push
00000000 68 db 0x68
00000001 0000 add [rax],al
00000003 FF db 0xFF
00000004 FF db 0xFF
The correct disassembly ought to be "push qword 0xffffffffffff0000" (i.e.
sign-extended). The 0x68 instruction is forced to a 64-bit data size.
Nobody/Anonymous
None
None
Public
|
Date: 2008-12-17 00:09 It's true that ndisasm disassembles 68 00 00 FF FF as that. |
Copyright © 2009 Geeknet, Inc. All rights reserved. Terms of Use