Re: [Capstone-users] Size of instruction is wrong

[Nguyen A. Q. <aq...@gm...>]

On Thu, Oct 15, 2015 at 12:24 PM, Michael <ma...@gm...> wrote:

> Hi,
>
> I just got Capstone today and wanted to try it out. It works fine (VS2013,
> Windows 7 x64) but then I wanted to test whether the length of instructions
> was correct. So I tried this code:
>
> http://ideone.com/tPzk26
>
> And the output was:
>
> http://puu.sh/kKNjX/caebd34832.png
>
> Where the left hand side shows the size of the instructions. The first two
> instructions are correct but the third instruction is wrong. It's supposed
> to be 5 bytes in length. Proof:
>
> http://puu.sh/kKNmk/de31ae4a0c.png
>
>
the above screenshot is confused: so is it "8b 05 b8 13 00", or "a1 8b 05
b8 13 00" ?

Capstone is right here on your sample, in which:

    8b 05 b8 13 00 = invalid instruction
    8b 05 b8 13 00 00 = mov    eax, dword ptr [0x13b8]


thanks.