Menu

#560 ndisasm truncates 64 bit origin specified in command line

open
nobody
None
5
2015-08-16
2015-08-16
No

Consider this code bash code:

xxd -r > test.bin << END
0000000: e8 35 64 93 53
END

Doing the following command after the above will give wrong results:

ndisasm -b 64 -o 0x649123ffe1 test.bin

I get this in the output:

9123FFE1 E835649353 call qword 0xffffffffe4b7641b

Apparently, ndisasm truncated anything beyond 32 bits of the origin specified.

Discussion


Log in to post a comment.