|
From: Kristis M. <kri...@as...> - 2005-03-03 04:05:07
|
Hello, I believe that this sequence: 0f 84 a9 fe ff ff je 0x72 0f 0b ud2a 78 00 js 0x1cd 68 36 22 c0 e9 push $0xe9c02236 is turned into: 0f 84 a9 fe ff ff je 0x72 0b 78 00 or 0x0(%eax),%edi 68 36 22 c0 e9 push $0xe9c02236 due to libdisasm2 flagging the "0f" in ud2a's "0f 0b" as invalid and then using the remaining "0b" to incorrectly interpret the "js" into an "or" In particular, quikdis reports: 1c3: jz 0xC013FBF6 invalid opcode 0F 1ca: or edi, [eax] Anyway I can get a patch for this ?? Thanks, Kristis |