Re: [Capstone-users] cs_disasm with CAPSTONE_X86_REDUCE

[Prasad D. <pd...@ic...>]

Thanks for the response.


I am using latest version (3.0.5?) available on the web site. Attached is the code (capstone.c) that I am using from a kernel driver.


I am building capstone_static_winkernel.lib with CAPSTONE_X86_REDUCE defined and then using it from my kernel driver. In this configuration, when I am disassembling the function that contains "lea r15, [someaddress]" instruction, it stops disassembling at this instruction. e.g. If the function that I am disassembling has 100 instructions and 25th instruction is "lea r15, [someaddress]", cs_diasm returns me 24 as the instruction count.



If I use static library capstone_static_winkernel.lib compiled with CAPSTONE_X86_REDUCE_NO, it disassembles fine.


Let me know if you need any more information.


Thanks.
-Prasad


On Nov 06, 2018, at 05:51 PM, Nguyen Anh Quynh <aq...@gm...> wrote:


which Capstone version are you using?


please post a minimal code to reproduce this issue, so i can debug it.


thanks.