{"action":"created","issue":{"url":"https://api.github.com/repos/aquynh/capstone/issues/621","repository_url":"https://api.github.com/repos/aquynh/capstone","labels_url":"https://api.github.com/repos/aquynh/capstone/issues/621/labels{/name}","comments_url":"https://api.github.com/repos/aquynh/capstone/issues/621/comments","events_url":"https://api.github.com/repos/aquynh/capstone/issues/621/events","html_url":"https://github.com/aquynh/capstone/issues/621","id":145652240,"number":621,"title":"wrong dissasembler on code with data reservation (DD, DB...)","user":{"login":"dorki","id":18124417,"avatar_url":"https://avatars.githubusercontent.com/u/18124417?v=3","gravatar_id":"","url":"https://api.github.com/users/dorki","html_url":"https://github.com/dorki","followers_url":"https://api.github.com/users/dorki/followers","following_url":"https://api.github.com/users/dorki/following{/other_user}","gists_url":"https://api.github.com/users/dorki/gists{/gist_id}","starred_url":"https://api.github.com/users/dorki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dorki/subscriptions","organizations_url":"https://api.github.com/users/dorki/orgs","repos_url":"https://api.github.com/users/dorki/repos","events_url":"https://api.github.com/users/dorki/events{/privacy}","received_events_url":"https://api.github.com/users/dorki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-04T11:05:02Z","updated_at":"2016-04-04T11:43:15Z","closed_at":null,"body":"hi there,\r\nbeen debugging my code for a while, then turned to PE explorer to see what i've missed, turn out that PEexplorer can somehow determine that a piece of code is actually reserved bytes and not opcode to dissembler..\r\n\r\nfor example for (intel 32bit):\r\n`8b e5 5d c3 8b ff bb 2c 40 20 97 2a 40 20 ab 2a 40 20 ef 2a 40 20 f9 2a 40 20 0d 2b 40 20 03 2b 40 20 e1 2b 40 20 68 2a 40 20 8d 2a 40 20 a1 2a 40 20 b5 2a 40 20 db 2a 40 20 e5 2a 40 20 d7 2b 40 20 bb 2c 40 20 20 0f 01 02 03 04 0f 0f 05 0f 0f 06 0f 07 0f 0f 08 09 0a 0b 0c 0d 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0e cc cc cc cc 55 8b ec`\r\n\r\n**Capstone**:\r\nmov\tesp, ebp\r\npop\tebp\r\nret\t\r\nmov\tedi, edi\r\nmov\tebx, 0x9700402c\r\nsub\tal, byte ptr [eax]\r\n.....\r\nmov\tebx, 0x402c\r\nsgdt\tptr [edx]\r\nadd\teax, dword ptr [edi + ecx]\r\nsyscall\t\r\n\r\nand ends here... \r\n\r\n**but PE for example gave me:**\r\n 8BE5                      \t\tmov\tesp,ebp\r\n 5D                        \t\tpop\tebp\r\n C3                        \t\tretn\r\n\r\n 8BFF                      \t\tAlign\t4\r\n\r\n BB2C4000                 \t\tdd\tCASE_00402CE4_PROC0000\r\n 972A4000                 \t\tdd\tCASE_00402CE4_PROC0001\r\n AB2A4000                 \t\tdd\tCASE_00402CE4_PROC0002\r\n EF2A4000                 \t\tdd\tCASE_00402CE4_PROC0003\r\n F92A4000                 \t\tdd\tCASE_00402CE4_PROC0004\r\n 0D2B4000                 \t\tdd\tCASE_00402CE4_PROC0005\r\n 032B4000                 \t\tdd\tCASE_00402CE4_PROC0006\r\n E12B4000                 \t\tdd\tCASE_00402CE4_PROC0007\r\n 682A4000                 \t\tdd\tCASE_00402CE4_PROC0008\r\n 8D2A4000                 \t\tdd\tCASE_00402CE4_PROC0009\r\n A12A4000                 \t\tdd\tCASE_00402CE4_PROC000A\r\n B52A4000                 \t\tdd\tCASE_00402CE4_PROC000B\r\n DB2A4000                 \t\tdd\tCASE_00402CE4_PROC000C\r\n E52A4000                 \t\tdd\tCASE_00402CE4_PROC000D\r\n D72B4000                 \t\tdd\tCASE_00402CE4_PROC000E\r\n BB2C4000                 \t\tdd\tCASE_00402CE4_PROC0000\r\n\r\n 000F010203040F0F050F+     \t\tdb\t00h, 0Fh, 01h, 02h, 03h, 04h, 0Fh, 0Fh, 05h, 0Fh, 0Fh, 06h, 0Fh, 07h, 0Fh, 0Fh\r\n 08090A0B0C0D0F0F0F0F+     \t\tdb\t08h, 09h, 0Ah, 0Bh, 0Ch, 0Dh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh\r\n 0F0F0F0F0F0F0F0F0F0F+     \t\tdb\t0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh\r\n 0F0F0F0F0F0F0F0F0F0F+     \t\tdb\t0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh\r\n 0F0F0F0F0F0F0F0F0F0F+     \t\tdb\t0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh\r\n 0F0F0F0F0F0F0F0F0F0F+     \t\tdb\t0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh\r\n 0F0F0F0F0F0F0F0E          \t\tdb\t0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Fh, 0Eh\r\n\r\n CCCCCCCC                  \t\tAlign\t8\r\n\r\n 55                        \t\tpush\tebp\r\n 8BEC                      \t\tmov\tebp,esp\r\n\r\n \r\nany idea ?\r\nthanks !"},"comment":{"url":"https://api.github.com/repos/aquynh/capstone/issues/comments/205260340","html_url":"https://github.com/aquynh/capstone/issues/621#issuecomment-205260340","issue_url":"https://api.github.com/repos/aquynh/capstone/issues/621","id":205260340,"user":{"login":"ibabushkin","id":10811417,"avatar_url":"https://avatars.githubusercontent.com/u/10811417?v=3","gravatar_id":"","url":"https://api.github.com/users/ibabushkin","html_url":"https://github.com/ibabushkin","followers_url":"https://api.github.com/users/ibabushkin/followers","following_url":"https://api.github.com/users/ibabushkin/following{/other_user}","gists_url":"https://api.github.com/users/ibabushkin/gists{/gist_id}","starred_url":"https://api.github.com/users/ibabushkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ibabushkin/subscriptions","organizations_url":"https://api.github.com/users/ibabushkin/orgs","repos_url":"https://api.github.com/users/ibabushkin/repos","events_url":"https://api.github.com/users/ibabushkin/events{/privacy}","received_events_url":"https://api.github.com/users/ibabushkin/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T11:43:15Z","updated_at":"2016-04-04T11:43:15Z","body":"The Capstone engine is just disassembling buffers, whereas PE explorer analyzes controlflow to determine what parts of those buffers are actually executed and represents other regions as data.\r\nTo get a similar behaviour using Capstone, analyze the instructions you disassemble and look into the SKIPDATA option(s) to, well, skip data. That way you would effectively reimplement the algorithm tools such as PE explorer use."}}