crabstone 3.0.3

data/test/test_x86.rb

@@ -0,0 +1,189 @@
+#!/usr/bin/env ruby
+
+# Library by Nguyen Anh Quynh
+# Original binding by Nguyen Anh Quynh and Tan Sheng Di
+# Additional binding work by Ben Nagy
+# (c) 2013 COSEINC. All Rights Reserved.
+
+# This is UGLY, but it's ported C test code, sorry. :(
+
+require 'crabstone'
+require 'stringio'
+
+module TestX86
+
+  X86_CODE64 = "\x55\x48\x8b\x05\xb8\x13\x00\x00"
+  X86_CODE16 = "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x05\x23\x01\x00\x00\x36\x8b\x84\x91\x23\x01\x00\x00\x41\x8d\x84\x39\x89\x67\x00\x00\x8d\x87\x89\x67\x00\x00\xb4\xc6"
+  X86_CODE32 = "\x8d\x4c\x32\x08\x01\xd8\x81\xc6\x34\x12\x00\x00\x05\x23\x01\x00\x00\x36\x8b\x84\x91\x23\x01\x00\x00\x41\x8d\x84\x39\x89\x67\x00\x00\x8d\x87\x89\x67\x00\x00\xb4\xc6"
+
+  include Crabstone
+  include Crabstone::X86
+
+  @platforms = [
+    Hash[
+      'arch' => ARCH_X86,
+      'mode' => MODE_16,
+      'code' => X86_CODE16,
+      'comment' => "X86 16bit (Intel syntax)"
+    ],
+    Hash[
+      'arch' => ARCH_X86,
+      'mode' => MODE_32,
+      'code' => X86_CODE32,
+      'syntax' => :att,
+      'comment' => "X86 32 (AT&T syntax)"
+    ],
+    Hash[
+      'arch' => ARCH_X86,
+      'mode' => MODE_32,
+      'code' => X86_CODE32,
+      'comment' => "X86 32 (Intel syntax)"
+    ],
+    Hash[
+      'arch' => ARCH_X86,
+      'mode' => MODE_64,
+      'code' => X86_CODE64,
+      'comment' => "X86 64 (Intel syntax)"
+    ]
+  ]
+
+  def self.uint32 i
+    Integer(i) & 0xffffffff
+  end
+
+  def self.uint64 i
+    Integer(i) & 0xffffffffffffffff
+  end
+
+  def self.print_detail cs, i, mode, sio
+
+    sio.puts("\tPrefix:#{i.prefix.to_a.map {|b| "0x%.2x" % b}.join(' ')} ")
+    sio.puts("\tOpcode:#{i.opcode.to_a.map {|b| "0x%.2x" % b}.join(' ')} ")
+    sio.printf("\trex: 0x%x\n", uint32(i[:rex]))
+    sio.printf("\taddr_size: %u\n", uint32(i[:addr_size]))
+    sio.printf("\tmodrm: 0x%x\n", i.modrm)
+    sio.printf("\tdisp: 0x%x\n", (self.uint32(i.disp)))
+
+    #   // SIB is not available in 16-bit mode
+    unless mode == MODE_16
+      sio.printf("\tsib: 0x%x\n", i.sib)
+      unless i.sib_index == REG_INVALID
+        sio.printf(
+          "\t\tsib_base: %s\n\t\tsib_index: %s\n\t\tsib_scale: %u\n",
+          cs.reg_name(i.sib_base),
+          cs.reg_name(i.sib_index),
+          i.sib_scale
+        )
+      end
+    end
+
+    sio.printf("\tsse_cc: %d\n", i[:sse_cc]) if i[:sse_cc].nonzero?
+    sio.printf("\tavx_cc: %d\n", i[:avx_cc]) if i[:avx_cc].nonzero?
+    sio.printf("\tavx_sae: True\n") if i[:avx_sae]
+    sio.printf("\tavx_rm: %d\n", i[:avx_rm]) if i[:avx_rm].nonzero?
+
+    if i.reads_reg?( :eax ) || i.reads_reg?( 19 ) || i.reads_reg?( REG_EAX )
+      print '[eax:r] '
+      unless i.reads_reg?( :eax ) && i.reads_reg?( 'eax' ) && i.reads_reg?( 19 ) && i.reads_reg?( REG_EAX )
+        fail "Error in reg read decomposition"
+      end
+    end
+
+    if i.writes_reg?( 'eax' ) || i.writes_reg?( 19 ) || i.writes_reg?( REG_EAX )
+      print '[eax:w] '
+      unless i.writes_reg?( 'eax' ) && i.writes_reg?( 19 ) && i.writes_reg?( REG_EAX )
+        fail "Error in reg write decomposition"
+      end
+    end
+
+    if (count=i.op_count(OP_IMM)).nonzero?
+      sio.puts "\timm_count: #{count}"
+      i.operands.select(&:imm?).each_with_index {|op,j|
+        sio.puts "\t\timms[#{j+1}]: 0x#{self.uint64(op.value).to_s(16)}"
+      }
+    end
+
+    if i.op_count > 0 then
+      sio.puts "\top_count: #{i.op_count}"
+      i.operands.each_with_index do |op,c|
+        if op.reg?
+          sio.puts "\t\toperands[#{c}].type: REG = #{cs.reg_name(op.value)}"
+        elsif op.imm?
+          sio.puts "\t\toperands[#{c}].type: IMM = 0x#{self.uint64(op.value).to_s(16)}"
+        elsif op.fp?
+          sio.puts "\t\toperands[#{c}].type: FP = 0x#{(self.uint32(op.value))}"
+        elsif op.mem?
+          sio.puts "\t\toperands[#{c}].type: MEM"
+          if op.value[:segment].nonzero?
+            sio.puts "\t\t\toperands[#{c}].mem.segment: REG = %s" % cs.reg_name(op.value[:segment])
+          end
+          if op.value[:base].nonzero?
+            sio.puts "\t\t\toperands[#{c}].mem.base: REG = %s" % cs.reg_name(op.value[:base])
+          end
+          if op.value[:index].nonzero?
+            sio.puts "\t\t\toperands[#{c}].mem.index: REG = %s" % cs.reg_name(op.value[:index])
+          end
+          if op.value[:scale] != 1
+            sio.puts "\t\t\toperands[#{c}].mem.scale: %u" % op.value[:scale]
+          end
+          if op.value[:disp].nonzero?
+            sio.puts "\t\t\toperands[#{c}].mem.disp: 0x%x" % (self.uint64(op.value[:disp]))
+          end
+        end
+
+        sio.printf("\t\toperands[#{c}].avx_bcast: %u\n", op[:avx_bcast]) if op[:avx_bcast].nonzero?
+        sio.printf("\t\toperands[#{c}].avx_zero_opmask: TRUE\n") if op[:avx_zero_opmask]
+        sio.printf("\t\toperands[#{c}].size: %u\n", op[:size])
+
+      end
+    end
+
+    sio.puts
+  end
+
+  ours = StringIO.new
+
+  #Test through all modes and architectures
+  begin
+    cs    = Disassembler.new(0,0)
+    print "X86 Test: Capstone v #{cs.version.join('.')} - "
+  ensure
+    cs.close
+  end
+  @platforms.each do |p|
+    ours.puts "****************"
+    ours.puts "Platform: #{p['comment']}"
+    ours.puts "Code:#{p['code'].bytes.map {|b| "0x%.2x" % b}.join(' ')} "
+    ours.puts "Disasm:"
+
+    cs    = Disassembler.new(p['arch'], p['mode'])
+    cs.decomposer = true
+    if p['syntax']
+      cs.syntax = p['syntax']
+    end
+    cache = nil
+
+    # This form is NOT RECOMMENDED in real code except as a last resort - use
+    # the block form if possible.
+    insns = cs.disasm(p['code'], 0x1000)
+
+    insns.each {|insn|
+      ours.puts "0x#{insn.address.to_s(16)}:\t#{insn.mnemonic}\t#{insn.op_str}"
+      self.print_detail(cs, insn, cs.mode, ours)
+      cache = insn
+    }
+    ours.printf("0x%x:\n", cache.address + cache.size)
+    ours.puts
+    cs.close
+  end
+
+  ours.rewind
+  theirs = File.binread(__FILE__ + ".SPEC")
+  if ours.read == theirs
+    puts "#{__FILE__}: PASS"
+  else
+    ours.rewind
+    puts ours.read
+    puts "#{__FILE__}: FAIL"
+  end
+end

data/test/test_x86.rb.SPEC

@@ -0,0 +1,579 @@
+****************
+Platform: X86 16bit (Intel syntax)
+Code:0x8d 0x4c 0x32 0x08 0x01 0xd8 0x81 0xc6 0x34 0x12 0x00 0x00 0x05 0x23 0x01 0x00 0x00 0x36 0x8b 0x84 0x91 0x23 0x01 0x00 0x00 0x41 0x8d 0x84 0x39 0x89 0x67 0x00 0x00 0x8d 0x87 0x89 0x67 0x00 0x00 0xb4 0xc6 
+Disasm:
+0x1000:	lea	cx, word ptr [si + 0x32]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x4c
+	disp: 0x32
+	op_count: 2
+		operands[0].type: REG = cx
+		operands[0].size: 2
+		operands[1].type: MEM
+			operands[1].mem.base: REG = si
+			operands[1].mem.disp: 0x32
+		operands[1].size: 2
+
+0x1003:	or	byte ptr [bx + di], al
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x08 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x1
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+			operands[0].mem.index: REG = di
+		operands[0].size: 1
+		operands[1].type: REG = al
+		operands[1].size: 1
+
+0x1005:	fadd	dword ptr [bx + di + 0x34c6]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0xd8 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x81
+	disp: 0x34c6
+	op_count: 1
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+			operands[0].mem.index: REG = di
+			operands[0].mem.disp: 0x34c6
+		operands[0].size: 4
+
+0x1009:	adc	al, byte ptr [bx + si]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x12 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x0
+	disp: 0x0
+	op_count: 2
+		operands[0].type: REG = al
+		operands[0].size: 1
+		operands[1].type: MEM
+			operands[1].mem.base: REG = bx
+			operands[1].mem.index: REG = si
+		operands[1].size: 1
+
+0x100b:	add	byte ptr [di], al
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x00 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x5
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = di
+		operands[0].size: 1
+		operands[1].type: REG = al
+		operands[1].size: 1
+
+0x100d:	and	ax, word ptr [bx + di]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x23 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x1
+	disp: 0x0
+	op_count: 2
+		operands[0].type: REG = ax
+		operands[0].size: 2
+		operands[1].type: MEM
+			operands[1].mem.base: REG = bx
+			operands[1].mem.index: REG = di
+		operands[1].size: 2
+
+0x100f:	add	byte ptr [bx + si], al
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x00 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x0
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+			operands[0].mem.index: REG = si
+		operands[0].size: 1
+		operands[1].type: REG = al
+		operands[1].size: 1
+
+0x1011:	mov	ax, word ptr ss:[si + 0x2391]
+	Prefix:0x00 0x36 0x00 0x00 
+	Opcode:0x8b 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x84
+	disp: 0x2391
+	op_count: 2
+		operands[0].type: REG = ax
+		operands[0].size: 2
+		operands[1].type: MEM
+			operands[1].mem.segment: REG = ss
+			operands[1].mem.base: REG = si
+			operands[1].mem.disp: 0x2391
+		operands[1].size: 2
+
+0x1016:	add	word ptr [bx + si], ax
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x01 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x0
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+			operands[0].mem.index: REG = si
+		operands[0].size: 2
+		operands[1].type: REG = ax
+		operands[1].size: 2
+
+0x1018:	add	byte ptr [bx + di - 0x73], al
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x00 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x41
+	disp: 0xffffff8d
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+			operands[0].mem.index: REG = di
+			operands[0].mem.disp: 0xffffffffffffff8d
+		operands[0].size: 1
+		operands[1].type: REG = al
+		operands[1].size: 1
+
+0x101b:	test	byte ptr [bx + di], bh
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x84 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x39
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+			operands[0].mem.index: REG = di
+		operands[0].size: 1
+		operands[1].type: REG = bh
+		operands[1].size: 1
+
+0x101d:	mov	word ptr [bx], sp
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x89 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x67
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = bx
+		operands[0].size: 2
+		operands[1].type: REG = sp
+		operands[1].size: 2
+
+0x1020:	add	byte ptr [di - 0x7679], cl
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x00 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x8d
+	disp: 0xffff8987
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = di
+			operands[0].mem.disp: 0xffffffffffff8987
+		operands[0].size: 1
+		operands[1].type: REG = cl
+		operands[1].size: 1
+
+0x1024:	add	byte ptr [eax], al
+	Prefix:0x00 0x00 0x00 0x67 
+	Opcode:0x00 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = eax
+		operands[0].size: 1
+		operands[1].type: REG = al
+		operands[1].size: 1
+
+0x1027:	mov	ah, -0x3a
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0xb4 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 2
+	modrm: 0x0
+	disp: 0x0
+	imm_count: 1
+		imms[1]: 0xffffffffffffffc6
+	op_count: 2
+		operands[0].type: REG = ah
+		operands[0].size: 1
+		operands[1].type: IMM = 0xffffffffffffffc6
+		operands[1].size: 1
+
+0x1029:
+
+****************
+Platform: X86 32 (AT&T syntax)
+Code:0x8d 0x4c 0x32 0x08 0x01 0xd8 0x81 0xc6 0x34 0x12 0x00 0x00 0x05 0x23 0x01 0x00 0x00 0x36 0x8b 0x84 0x91 0x23 0x01 0x00 0x00 0x41 0x8d 0x84 0x39 0x89 0x67 0x00 0x00 0x8d 0x87 0x89 0x67 0x00 0x00 0xb4 0xc6 
+Disasm:
+0x1000:	leal	8(%edx, %esi), %ecx
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x4c
+	disp: 0x8
+	sib: 0x32
+		sib_base: edx
+		sib_index: esi
+		sib_scale: 1
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = edx
+			operands[0].mem.index: REG = esi
+			operands[0].mem.disp: 0x8
+		operands[0].size: 4
+		operands[1].type: REG = ecx
+		operands[1].size: 4
+
+0x1004:	addl	%ebx, %eax
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x01 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0xd8
+	disp: 0x0
+	sib: 0x0
+	op_count: 2
+		operands[0].type: REG = ebx
+		operands[0].size: 4
+		operands[1].type: REG = eax
+		operands[1].size: 4
+
+0x1006:	addl	$0x1234, %esi
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x81 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0xc6
+	disp: 0x0
+	sib: 0x0
+	imm_count: 1
+		imms[1]: 0x1234
+	op_count: 2
+		operands[0].type: IMM = 0x1234
+		operands[0].size: 4
+		operands[1].type: REG = esi
+		operands[1].size: 4
+
+0x100c:	addl	$0x123, %eax
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x05 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	imm_count: 1
+		imms[1]: 0x123
+	op_count: 2
+		operands[0].type: IMM = 0x123
+		operands[0].size: 4
+		operands[1].type: REG = eax
+		operands[1].size: 4
+
+0x1011:	movl	%ss:0x123(%ecx, %edx, 4), %eax
+	Prefix:0x00 0x36 0x00 0x00 
+	Opcode:0x8b 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x84
+	disp: 0x123
+	sib: 0x91
+		sib_base: ecx
+		sib_index: edx
+		sib_scale: 4
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.segment: REG = ss
+			operands[0].mem.base: REG = ecx
+			operands[0].mem.index: REG = edx
+			operands[0].mem.scale: 4
+			operands[0].mem.disp: 0x123
+		operands[0].size: 4
+		operands[1].type: REG = eax
+		operands[1].size: 4
+
+0x1019:	incl	%ecx
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x41 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	op_count: 1
+		operands[0].type: REG = ecx
+		operands[0].size: 4
+
+0x101a:	leal	0x6789(%ecx, %edi), %eax
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x84
+	disp: 0x6789
+	sib: 0x39
+		sib_base: ecx
+		sib_index: edi
+		sib_scale: 1
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = ecx
+			operands[0].mem.index: REG = edi
+			operands[0].mem.disp: 0x6789
+		operands[0].size: 4
+		operands[1].type: REG = eax
+		operands[1].size: 4
+
+0x1021:	leal	0x6789(%edi), %eax
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x87
+	disp: 0x6789
+	sib: 0x0
+	op_count: 2
+		operands[0].type: MEM
+			operands[0].mem.base: REG = edi
+			operands[0].mem.disp: 0x6789
+		operands[0].size: 4
+		operands[1].type: REG = eax
+		operands[1].size: 4
+
+0x1027:	movb	$-0x3a, %ah
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0xb4 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	imm_count: 1
+		imms[1]: 0xffffffffffffffc6
+	op_count: 2
+		operands[0].type: IMM = 0xffffffffffffffc6
+		operands[0].size: 1
+		operands[1].type: REG = ah
+		operands[1].size: 1
+
+0x1029:
+
+****************
+Platform: X86 32 (Intel syntax)
+Code:0x8d 0x4c 0x32 0x08 0x01 0xd8 0x81 0xc6 0x34 0x12 0x00 0x00 0x05 0x23 0x01 0x00 0x00 0x36 0x8b 0x84 0x91 0x23 0x01 0x00 0x00 0x41 0x8d 0x84 0x39 0x89 0x67 0x00 0x00 0x8d 0x87 0x89 0x67 0x00 0x00 0xb4 0xc6 
+Disasm:
+0x1000:	lea	ecx, dword ptr [edx + esi + 8]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x4c
+	disp: 0x8
+	sib: 0x32
+		sib_base: edx
+		sib_index: esi
+		sib_scale: 1
+	op_count: 2
+		operands[0].type: REG = ecx
+		operands[0].size: 4
+		operands[1].type: MEM
+			operands[1].mem.base: REG = edx
+			operands[1].mem.index: REG = esi
+			operands[1].mem.disp: 0x8
+		operands[1].size: 4
+
+0x1004:	add	eax, ebx
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x01 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0xd8
+	disp: 0x0
+	sib: 0x0
+	op_count: 2
+		operands[0].type: REG = eax
+		operands[0].size: 4
+		operands[1].type: REG = ebx
+		operands[1].size: 4
+
+0x1006:	add	esi, 0x1234
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x81 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0xc6
+	disp: 0x0
+	sib: 0x0
+	imm_count: 1
+		imms[1]: 0x1234
+	op_count: 2
+		operands[0].type: REG = esi
+		operands[0].size: 4
+		operands[1].type: IMM = 0x1234
+		operands[1].size: 4
+
+0x100c:	add	eax, 0x123
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x05 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	imm_count: 1
+		imms[1]: 0x123
+	op_count: 2
+		operands[0].type: REG = eax
+		operands[0].size: 4
+		operands[1].type: IMM = 0x123
+		operands[1].size: 4
+
+0x1011:	mov	eax, dword ptr ss:[ecx + edx*4 + 0x123]
+	Prefix:0x00 0x36 0x00 0x00 
+	Opcode:0x8b 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x84
+	disp: 0x123
+	sib: 0x91
+		sib_base: ecx
+		sib_index: edx
+		sib_scale: 4
+	op_count: 2
+		operands[0].type: REG = eax
+		operands[0].size: 4
+		operands[1].type: MEM
+			operands[1].mem.segment: REG = ss
+			operands[1].mem.base: REG = ecx
+			operands[1].mem.index: REG = edx
+			operands[1].mem.scale: 4
+			operands[1].mem.disp: 0x123
+		operands[1].size: 4
+
+0x1019:	inc	ecx
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x41 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	op_count: 1
+		operands[0].type: REG = ecx
+		operands[0].size: 4
+
+0x101a:	lea	eax, dword ptr [ecx + edi + 0x6789]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x84
+	disp: 0x6789
+	sib: 0x39
+		sib_base: ecx
+		sib_index: edi
+		sib_scale: 1
+	op_count: 2
+		operands[0].type: REG = eax
+		operands[0].size: 4
+		operands[1].type: MEM
+			operands[1].mem.base: REG = ecx
+			operands[1].mem.index: REG = edi
+			operands[1].mem.disp: 0x6789
+		operands[1].size: 4
+
+0x1021:	lea	eax, dword ptr [edi + 0x6789]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8d 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x87
+	disp: 0x6789
+	sib: 0x0
+	op_count: 2
+		operands[0].type: REG = eax
+		operands[0].size: 4
+		operands[1].type: MEM
+			operands[1].mem.base: REG = edi
+			operands[1].mem.disp: 0x6789
+		operands[1].size: 4
+
+0x1027:	mov	ah, -0x3a
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0xb4 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 4
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	imm_count: 1
+		imms[1]: 0xffffffffffffffc6
+	op_count: 2
+		operands[0].type: REG = ah
+		operands[0].size: 1
+		operands[1].type: IMM = 0xffffffffffffffc6
+		operands[1].size: 1
+
+0x1029:
+
+****************
+Platform: X86 64 (Intel syntax)
+Code:0x55 0x48 0x8b 0x05 0xb8 0x13 0x00 0x00 
+Disasm:
+0x1000:	push	rbp
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x55 0x00 0x00 0x00 
+	rex: 0x0
+	addr_size: 8
+	modrm: 0x0
+	disp: 0x0
+	sib: 0x0
+	op_count: 1
+		operands[0].type: REG = rbp
+		operands[0].size: 8
+
+0x1001:	mov	rax, qword ptr [rip + 0x13b8]
+	Prefix:0x00 0x00 0x00 0x00 
+	Opcode:0x8b 0x00 0x00 0x00 
+	rex: 0x48
+	addr_size: 8
+	modrm: 0x5
+	disp: 0x13b8
+	sib: 0x0
+	op_count: 2
+		operands[0].type: REG = rax
+		operands[0].size: 8
+		operands[1].type: MEM
+			operands[1].mem.base: REG = rip
+			operands[1].mem.disp: 0x13b8
+		operands[1].size: 8
+
+0x1008:
+