x64dbg / x64dbg

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Home Page:http://x64dbg.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Invalid behavior of MOV in command console

notpidgey opened this issue · comments

Operating System

Windows 64 bit 22H2

x64dbg Version

2024-02-19

Describe the issue

Unsure if this is the intended behavior or not.

mov eax, ? (mov with 32 bit operand width) should clear the upper 32 bits of rax on 64 bit mode. However, this behavior is not reflected when performing the same instruction in the command console. Instead "mov eax, ebx" will set the lower 32 bits of rax and not clear the upper 32. This behavior can also be replicated with a memory source operand or an immediate value.

Steps to reproduce

  1. Open 64 bit program in x64dbg 64 bit version.
  2. Set a breakpoint on any instruction
  3. Go below "Dump" windows and type "mov eax, ebx" or whichever 32 bit mov instruction you would like to perform.

Attachments

No response

This is intended behavior. If you want to clear the upper bits you can write mov rax, ebx