How to interpret the opcode manually?

问题:

77f4bcbc 8945fc          mov     dword ptr [ebp-4],eax

And here's the rule:

88  /r   MOV r/m8,r8       2/2           Move byte register to r/m byte
89  /r   MOV r/m16,r16     2/2           Move word register to r/m word
89  /r   MOV r/m32,r32     2/2           Move dword register to r/m dword

How to interpret 8945fc to mov dword ptr [ebp-4],eax?

回答1:

We have here a three-byte instruction: 89 45 fc. The first byte is the opcode byte. Looking it up in the table, we can see that it's a MOV instruction and it takes a Mod R/M byte. The Mod R/M byte has the following layout:

 7  6   5  4  3   2  1  0
+-----+---------+---------+
| Mod |   Reg   |   R/M   | 
+-----+---------+---------+

Let's look at the second byte of the instruction. 0x45 is 01.000.101 in binary. Thus, Mod is 01, Reg is 000 and R/M is 101.

Looking up in the reference, e.g. here, we can see that the combination of Mod=01 and R/M=101 corresponds to the [EBP+sbyte] operand. The "sbyte" is an 8-bit signed displacement which is encoded in the third byte: 0xFC. Since the displacement is signed, it has to be interpreted as such number, i.e. -4.

The "/r" note next to the instruction tells us that the register (second) operand is specified by the Reg field of the instruction. Reg=000 is al/ax/eax. Assuming a 32-bit mode by default, this will mean eax.

Assembling all of the above, we get

MOV [EBP-4], EAX

回答2:

89 is the opcode
45 encodes the source and destination
fc is the offset (-4)

回答3:

If you want to write your own disassembler, here is what you need.

For a quick summary, look here

回答4:

look for mov dword ptr [ebp-4],eax you have 8 bits of code.you can get it easily here is the procedure first six bits are given or should be memorized for mov command and then add on LSB the destination bit(D) where d=1 when there is a register in the destination or d=0 when the register is in source.Here the register eax is in source side so should add 0 and then the last bit which is called word bit(W bit) is add in the LSB side after destination bit where W bit= 1 when there is 16/32 bit register or 0 when there is 8 bit register so now according to the command "mov dword ptr [ebp-4],eax"
the d bit=0 and w bit =1 now you get the 8 bits of opcode then you have to findout the MOD(R/M) field. for this you have to find out the 3 things. 1) mod value 2) register value 3) R/M value here is the format +-----+---------+---------+ | Mod | Reg | R/M | +-----+---------+---------+ as mentioned in above answer then check in the command mov dword ptr [ebp-4],eax there is 8 bit displacement according to -4 then mod value =01 MOD VALUES: 00 for no displacement 01 for 8 bit displacement 10 for 16 bit displacment 11 for register to register transfer

so here mod=01 then for reg eax the value is 000 and for (R/M) the value is 101

so the R/M field 8 bits are

01000101 hope this description will help