diff --git a/librz/analysis/p/analysis_arm_hacks.inc b/librz/analysis/p/analysis_arm_hacks.inc
index 73eda97107..6f1a366ff1 100644
--- a/librz/analysis/p/analysis_arm_hacks.inc
+++ b/librz/analysis/p/analysis_arm_hacks.inc
@@ -105,7 +105,7 @@ static int hack_handle_dp_imm(ut32 insn, RzAnalysisOp *op) {
 		const bool sf = (insn >> 31) & 0x1;
 		const bool op_ = (insn >> 30) & 0x1;
 		const bool S = (insn >> 29) & 0x1;
-		const bool o2 = (insn >> 2) & 0x1;
+		const bool o2 = (insn >> 22) & 0x1;
 		if (sf && !S && !o2) {
 			if (op_ ) {
 				// subg
@@ -147,8 +147,8 @@ static inline int hackyArmAnal(RzAnalysis *a, RzAnalysisOp *op, const ut8 *buf,
 	int ret = -1;
 	// Hacky support for ARMv8.3 and ARMv8.5
 	if (a->bits == 64 && len >= 4) {
-		ut32 *insn = (ut32 *)buf;
-		int insn_class = (*insn >> 25) & 0xf;
+		ut32 insn = rz_read_ble32 (buf, a->big_endian);
+		int insn_class = (insn >> 25) & 0xf;
 		// xpaci // e#43c1da
 		if (!memcmp (buf + 1, "\x43\xc1\xda", 3)) {
 			op->type = RZ_ANALYSIS_OP_TYPE_MOV;
@@ -170,18 +170,18 @@ static inline int hackyArmAnal(RzAnalysis *a, RzAnalysisOp *op, const ut8 *buf,
 		case 5:
 		case 13:
 			// irg, subp, gmi, subps
-			ret = hack_handle_dp_reg (*insn, op);
+			ret = hack_handle_dp_reg (insn, op);
 			break;
 		// Data Processing -- Immediate
 		case 8:
 		case 9:
 			// addg, subg
-			ret = hack_handle_dp_imm (*insn, op);
+			ret = hack_handle_dp_imm (insn, op);
 			break;
 		case 10:
 		case 11:
 			// bti
-			ret = hack_handle_br_exc_sys (*insn, op);
+			ret = hack_handle_br_exc_sys (insn, op);
 			break;
 		// Loads and Stores
 		case 4:
@@ -189,7 +189,7 @@ static inline int hackyArmAnal(RzAnalysis *a, RzAnalysisOp *op, const ut8 *buf,
 		case 12:
 		case 14:
 			// stg, stzgm, ldg, stzg, st2g, stgm, stz2g, ldgm, stgp
-			ret = hack_handle_ldst (*insn, op);
+			ret = hack_handle_ldst (insn, op);
 			break;
 		default:
 			break;
diff --git a/librz/asm/p/asm_arm_hacks.inc b/librz/asm/p/asm_arm_hacks.inc
index 7c48288c89..411460e126 100644
--- a/librz/asm/p/asm_arm_hacks.inc
+++ b/librz/asm/p/asm_arm_hacks.inc
@@ -8,7 +8,7 @@ static char *hack_handle_dp_imm(ut32 insn) {
 		const bool sf = (insn >> 31) & 0x1;
 		const bool op = (insn >> 30) & 0x1;
 		const bool S = (insn >> 29) & 0x1;
-		const bool o2 = (insn >> 2) & 0x1;
+		const bool o2 = (insn >> 22) & 0x1;
 		if (sf && !S && !o2) {
 			if (op) {
 				mnemonic = "subg";
@@ -221,26 +221,26 @@ static int hackyArmAsm(RzAsm *a, RzAsmOp *op, const ut8 *buf, int len) {
 	char *buf_asm = NULL;
     // Hacky support for ARMv8.5
 	if (a->bits == 64 && len >= 4) {
-		ut32 *insn = (ut32 *)buf;
-		int insn_class = (*insn >> 25) & 0xf;
+		ut32 insn = rz_read_ble32 (buf, a->big_endian);
+		int insn_class = (insn >> 25) & 0xf;
 		switch (insn_class) {
 		// Data Processing -- Register
 		case 5:
 		case 13:
 			// irg, subp, gmi, subps
-			buf_asm = hack_handle_dp_reg (*insn);
+			buf_asm = hack_handle_dp_reg (insn);
 			break;
 		// Data Processing -- Immediate
 		case 8:
 		case 9:
 			// addg, subg
-			buf_asm = hack_handle_dp_imm (*insn);
+			buf_asm = hack_handle_dp_imm (insn);
 			break;
 		// Branches, Exception generating, and System instructions
 		case 10:
 		case 11:
 			// bti
-			buf_asm = hack_handle_br_exc_sys (*insn);
+			buf_asm = hack_handle_br_exc_sys (insn);
 			break;
 		// Loads and Stores
 		case 4:
@@ -248,7 +248,7 @@ static int hackyArmAsm(RzAsm *a, RzAsmOp *op, const ut8 *buf, int len) {
 		case 12:
 		case 14:
 			// stg, stzgm, ldg, stzg, st2g, stgm, stz2g, ldgm, stgp
-			buf_asm = hack_handle_ldst (*insn);
+			buf_asm = hack_handle_ldst (insn);
 			break;
 		default:
 			break;
diff --git a/test/db/anal/arm64 b/test/db/anal/arm64
index 61ca8e6e5c..f42c45068a 100644
--- a/test/db/anal/arm64
+++ b/test/db/anal/arm64
@@ -125,6 +125,71 @@ family: sec
 EOF
 RUN
 
+NAME=ao mte big endian
+FILE=-
+ARGS=-a arm -b 64 -e cfg.bigendian=true
+CMDS=<<EOF
+wx 91a0090c918201099ac813e8
+ao@0
+?e ---
+ao@4
+?e ---
+ao@8
+EOF
+EXPECT=<<EOF
+address: 0x0
+opcode: addg x12, x8, 0x0, 0x2
+esilcost: 0
+disasm: addg x12, x8, 0x0, 0x2
+pseudo: addg x12,x8,0x0, 0x2 
+mnemonic: addg
+mask: ffffffff
+prefix: 0
+id: 0
+bytes: 91a0090c
+refptr: 0
+size: 4
+sign: false
+type: add
+cycles: 0
+family: sec
+---
+address: 0x4
+opcode: addg x9, x8, 0x20, 0x0
+esilcost: 0
+disasm: addg x9, x8, 0x20, 0x0
+pseudo: addg x9,x8,0x20, 0x0 
+mnemonic: addg
+mask: ffffffff
+prefix: 0
+id: 0
+bytes: 91820109
+refptr: 0
+size: 4
+sign: false
+type: add
+cycles: 0
+family: sec
+---
+address: 0x8
+opcode: irg x8, sp, x8
+esilcost: 0
+disasm: irg x8, sp, x8
+pseudo: irg x8,sp,x8 
+mnemonic: irg
+mask: ffffffff
+prefix: 0
+id: 0
+bytes: 9ac813e8
+refptr: 0
+size: 4
+sign: false
+type: mov
+cycles: 0
+family: sec
+EOF
+RUN
+
 NAME=Variable analysis with stp/preindexed str
 FILE=-
 ARGS=-a arm -b 64
diff --git a/test/db/asm/arm_64 b/test/db/asm/arm_64
index bce4e76f90..5f2dfe2130 100644
--- a/test/db/asm/arm_64
+++ b/test/db/asm/arm_64
@@ -267,6 +267,7 @@ a "msr sp_el0, x3" 034118d5
 a "cbnz w3, 0x1fffd4" a3feff35
 a "cbz x3, 0x1fffe8" 43ffffb4
 d "addg x0, sp, 0x80, 0x4" e0138891
+dE "addg x12, x8, 0x0, 0x2" 91a0090c
 d "subg x0, sp, 0x20, 0xf" e03f82d1
 d "irg sp, x0" 1f10df9a
 d "irg x13, x3, x7" 6d10c79a