Cyberchef: Bug report : Issue with call instruction in x86 disassembler.

[mylifeisabug]

In 16-bit code, an intra-segment direct CALL (opcode starting with 0xE8) should only be three bytes long and take a single 16-bit displacement like so: 0xE8, disp-low, disp-high

But in the x86 disassembler, with the "Bit mode" field set to 16, the two bytes (in this case opcodes) following disp-high are lumped together with the CALL opcode and ignored.

For instance, when the bytes E8 00 00 90 90 are entered CALL some_loc is the output, but it should be CALL some_loc NOP NOP. The two NOPs are missing.

[n1474335]

Hi @mylifeisabug, thanks for raising this. The x86-64-Disassembler-JS library is used for this operation, so it will have to be fixed there. If you raise the bug with them, feel free to link to this issue.

Thanks

[mylifeisabug]

I raised the issue and now the bug has been fixed.

[n1474335]

Thanks for following this up. I've updated the library in CyberChef so this now works as expected (once Travis CI has finished building).