- Mastering Reverse Engineering
- Reginald Wong
- 234字
- 2021-06-10 19:40:31
Opcode bytes
Every instruction has an equivalent opcode (operation code) byte:
Address Opcode Instructions
00A92D7C B8 00000080 MOV EAX,80000000h
00A92D81 B9 02000000 MOV ECX,2
00A92D86 F7E1 MUL ECX
In the preceding code, the MOV instruction is equivalent to the B8 opcode byte. The MOV instruction at the 00A92D81 address is equivalent to B9. The difference between the two MOV instructions is the register into which the DWORD value is moved. There are a total of 5 bytes consumed in MOV EAX, 80000000h. It consists of the opcode byte, B8, and the operand value, 80000000h. The same number of bytes is also used in MOV ECX, 2, and MUL ECX uses 2 bytes.
MOV EAX, 80000000h is located at 00A92D7ch. Add 5 bytes (becomes 00A92D81) and we get to the address of the next instruction. Viewing the code in the memory would look like this:
Address Bytes
00A92D7C B8 00 00 00 80 B9 02 00 00 00 F7 E1
A dump of memory is usually shown in memory dumpers in paragraphs or 16 bytes per line and address aligned to 10h.
Assembly language instructions can be categorized as follows:
- Copying and accessing data instructions (for example, MOV, LEA, and MOVB)
- Arithmetic instructions (for example, ADD, SUB, MUL, and DIV)
- Binary logic instructions (for example, XOR, NOT, SHR, and ROL)
- Flow control (for example, JMP, CALL, CMP, and INT)
- 工業(yè)互聯(lián)網(wǎng)安全
- Learning Python for Forensics
- Rootkit和Bootkit:現(xiàn)代惡意軟件逆向分析和下一代威脅
- 黑客攻防入門(mén)秘笈
- 工業(yè)控制網(wǎng)絡(luò)安全技術(shù)
- Learning Veeam? Backup & Replication for VMware vSphere
- 零信任網(wǎng)絡(luò):在不可信網(wǎng)絡(luò)中構(gòu)建安全系統(tǒng)(第2版)
- 安全防御入門(mén)手冊(cè)
- 人工智能安全(精裝版)
- Mastering Reverse Engineering
- 華為防火墻實(shí)戰(zhàn)指南
- 持續(xù)集成:軟件質(zhì)量改進(jìn)和風(fēng)險(xiǎn)降低之道
- Cybersecurity Threats,Malware Trends,and Strategies
- ATT&CK框架實(shí)踐指南(第2版)
- 網(wǎng)站入侵與腳本技術(shù)快速防殺