0

I have an issue with the C++ xed2-Intel64 library. Some opcodes are not well cut, for example the MOV opcode with objdump :

49 89 d1 : mov rsp rbp

But I obtain with xed_decode and the mode : 

xed_decoded_inst_set_mode(&xedd, XED_MACHINE_MODE_LEGACY_32, XED_ADDRESS_WIDTH_64b);

49 : DEC eflag eax
89 d1 : MOV esp ebp

How can I avoid that ?
Thanks.

Martin
  • 113
  • 7

1 Answers1

1

Pass the XED_MACHINE_MODE_LONG_64 flag instead of the XED_MACHINE_MODE_LEGACY_32 to decode the instruction using 64-bit instruction decoding rules.

Ross Ridge
  • 38,414
  • 7
  • 81
  • 112