disasm | Interactive Disassembler GUI - This Repository is NOT

Capstone is architecture-independent. It doesn't understand PE files or elf files. You just feed it bytes of machine language for whatever processor you have.

RIP is the 64-bit program counter on x86-64. The disassembler is using RIP to keep track of the address of each instruction.

exampleRip is the start address for exampleCode, to be shown as the address of each instruction.

Normally you'd use a single 64-bit integer variable for that, but JavaScript numbers are IEEE double floating point so they round large numbers to a multiple of some power of 2, i.e. round away the low bits of big numbers, making it unusable for kernel addresses (in the high half of the canonical address range). (awk also uses double, and https://unix.stackexchange.com/questions/649013/why-does-awk-print-0xffffffffbb6002e0-as-ffffffffbb600000-using-printf on unix.SE is an example of the effect, with FP explanation.)

That's the point of this comment:

// You have to enable the bigint feature to get i64/u64 APIs, not all browsers support BigInt

They're explaining that they're not using the BigInt feature, so instead they use two variables (exampleRipHi and exampleRipLo) to implement one 64-bit variable.

Yes, you can do that, just like for any other C++ code.

Of course, this code runs as part of mksnapshot, and what it does is it creates (part of) a "builtin" code object that can handle appending elements to JavaScript arrays. Line 2869 will put a comment into the code object's comment section (if you are running with the --code-comments flag), line 2870 will define a label that will be used for conditional jumps later.

So just to be clear, this code does not run when you actually append elements to arrays. At that time, the builtin generated by this code will run, and debugging that requires different techniques (see the other answer).

EDIT to address questions in comments:

If i enter p kind in line 2870,can i get the value of kind? if i enter p ElementsKindToString in this function,can i get the address of function ElementsKindToString?

Yes, of course, this is plain C++. (Also, why do you ask? Just try it!)

how could i break in gdb before the Turbofan backend translate this function to machine code and get the debugging format i posted above.

Run mksnapshot in GDB and set a breakpoint on the line you want, then switch the view mode as desired. (Again, this is regular GDB usage; if you need a GDB tutorial then please search for one, there are plenty on the 'net.)

While you haven't directly asked for it, I have a suspicion that what you really want to do is step through the generated builtins instruction-by-instruction and see the CSA source that was responsible for generating them. That, unfortunately, is not possible, because the builtins and their generators run at different times (and even in different binaries!).

Disasm will disassemble from start of code. You should pass raw data corresponding to code section, not the beginning of PE file, where PE headers reside:

It's really a bit odd that it doesn't find it given that it's alongside attach_pydevd.py and given that attach_pydevd.py is executed as a __main__ module it should (in theory) be able to find it... but practice it seems is sometimes different ;)

So, try to do the following: open attach_pydevd.py and add sys.path.append(os.path.dirname(__file__)) as the first line of the def main(setup): to see if it fixes your issue (if it does, I'll also do the fix in the debugger side).

I don't think I'll be able to answer to everything. I am a beginner too so I may say some things not exact. But, I'll try my best and I think I can bring you some things.

No, compilers do not put data in code sections (correct me if I am wrong). There is the section .data (for initialized data) and section .bss (for uninitialized data).

I think, I'll better show you an example of a program which prints hello world (for linux because it's much simpler and I don't know how to do with windows. in x64 but it's like x86. Just the names of the syscalls and the registers that are different. x64 is for 64 bits and x86 for 32 bits).

The technical term for decompiling assembly back into C is "turning hamburger back into cows". The generated assembly will not be a 1-to-1 translation of the source, and depending on the level of optimization may be radically different. You will get something functionally equivalent to the original source, but how closely it resembles that source in structure is heavily variable.

Short answer: .exe ≠ .com

Hint: notice the MZ signature as two first bytes in the output of step 5 :-P

Long answer:

Microsoft's executable .exe format has more than just code. First of all it starts with a special signature (initials of the format's creator) followed by quite a bit of information that describes the organization of the code.

In contrast a .com file is just a code, meaning the very first byte of it is what gets executed once the file is loaded into memory.

The first disassembly you get is a wrong one (yes, the first one is wrong, not the second!) as it tries to start the parsing with the first byte instead of jumping on to the actual code.

dumpbin is intelligent enough to properly parse the header of that .exe file and begins the disassembly of the actual code.

Solution

If you'd like to compare the disassembly output you either have to make sure that your NASM is aware of the type of file and properly parses its header or... simplify your life and convert the .exe into a .com in which case both disassembling operations should produce the same output (barring potential bugs, of course)

The last time I was converting an .exe file into a .com was many years ago with a utility called exe2bin. A quick search online shows that this was during the days of Windows XP and is no longer shipped with the OS. Though I see no reason for it to not work if you download it from some place.

Nevermind, it seems to be an issue with a newer JDK. I recently switched to JDK 11. The fix is to wait till Capstone supports Java 9 and higher or to use Java 8 so indeed it's a Capstone bug.

EDIT:
This issue is now fixed.