Re: [Capstone-users] Decoding AArch64 (ARM64) instructions via Python bindings (unsuccessful attempts)

[David A. <dav...@gm...>]

Why is it that I can copy & paste objdump -d produced x86_64 machine code to 
www.cenigma.org and get the correct result, but I cannot do the same for
aarch64.

## x86_64

 45d4e4:       4c 8b ac 24 b0 00 00    mov    0xb0(%rsp),%r13
 45d4eb:       00


0	 4c8bac24b0000000	movq	 0xb0(%rsp), %r13

$ lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
[snip]

## aarch64

   1588:       bc6478a1        ldr     s1, [x5,x4,lsl #2]
   158c:       bc2279a0        str     s0, [x13,x2,lsl #2]
   1590:       bc6b79a0        ldr     s0, [x13,x11,lsl #2]

bc 64 78 a1
bc 22 79 a0
bc 6b 79 a0

Error: Failed to disassemble! Invalid input?

Setting "Big Endian" instead of "Little Endian" provides correct result:

0	 bc6478a1	ldr	 s1, [x5, x4, lsl #2]
4	 bc2279a0	str	 s0, [x13, x2, lsl #2]
8	 bc6b79a0	ldr	 s0, [x13, x11, lsl #2]

$ lscpu
Architecture:          aarch64
Byte Order:            Little Endian
[snip]

Both systems are Linux.

Why is that it works different for little endian machines?

david