官术网_书友最值得收藏!

Opcode bytes

Every instruction has an equivalent opcode (operation code) byte:

Address     Opcode          Instructions
00A92D7C B8 00000080 MOV EAX,80000000h
00A92D81 B9 02000000 MOV ECX,2
00A92D86 F7E1 MUL ECX

In the preceding code, the MOV instruction is equivalent to the B8 opcode byte. The MOV instruction at the 00A92D81 address is equivalent to B9. The difference between the two MOV instructions is the register into which the DWORD value is moved. There are a total of 5 bytes consumed in MOV EAX, 80000000h. It consists of the opcode byte, B8, and the operand value, 80000000h. The same number of bytes is also used in MOV ECX, 2, and MUL ECX uses 2 bytes.

MOV EAX, 80000000h is located at 00A92D7ch. Add 5 bytes (becomes 00A92D81) and we get to the address of the next instruction. Viewing the code in the memory would look like this:

Address     Bytes
00A92D7C B8 00 00 00 80 B9 02 00 00 00 F7 E1

A dump of memory is usually shown in memory dumpers in paragraphs or 16 bytes per line and address aligned to 10h.

Assembly language instructions can be categorized as follows:

  • Copying and accessing data instructions (for example, MOV, LEA, and MOVB)
  • Arithmetic instructions (for example, ADD, SUB, MUL, and DIV)
  • Binary logic instructions (for example, XOR, NOT, SHR, and ROL)
  • Flow control (for example, JMP, CALL, CMP, and INT)
主站蜘蛛池模板: 吉林省| 湘西| 九寨沟县| 西昌市| 桑植县| 龙游县| 宣武区| 安岳县| 松阳县| 泸定县| 福泉市| 泰来县| 类乌齐县| 遂川县| 兴文县| 凤阳县| 石门县| 白玉县| 鄯善县| 金溪县| 鄱阳县| 邵阳县| 驻马店市| 江门市| 鲁山县| 舟山市| 芦溪县| 泰州市| 泰来县| 麦盖提县| 永嘉县| 杨浦区| 呼伦贝尔市| 周口市| 沭阳县| 鹿泉市| 永平县| 原平市| 涿鹿县| 安岳县| 汾西县|