CODEWITHSUNDEEP
assemblyarchitecturex86
pythoniku
pythoniku

Reputation: 3672

How do I know the length of instruction in assembly?

I have come cross a segment of code like this:

jmp 0x26 #2 bytes
popl %esi #1 bytes
movl %esi,0x8(%esi) # 3 bytes
movb $0x0,0x7(%esi) # 4 bytes

.....

.string \"/bin/sh\" #8 bytes

I wonder how dose the author know how many bytes for each instruction?

Upvotes: 0

Views: 114

Answers (1)

user257111
user257111

Reputation:

I love how the first comment you get is essentially the answer... but it's not in the answer box! So I'll expand upon that.

So, as you've gathered, you have to "know" - and you know this by looking up the instruction in the Intel manual.

I'll give you a straightforward example If you want to work out the size of say mov rax, [rsp+8] you could assemble this in nasm:

 BITS 64
 mov rax, [rsp+8]

With the following command:

 nasm -fbin test.asm -o test.bin

Examining test.bin, you'll see in Hex it is:

 48 8B 44 24 08

Here 8B represents the mov instruction. The 48 preceding it is a REX prefix with the w property set (indicating a 64-bit target). The last byte, 08, represents the displacement from the previous register, which is 24, which indicates esp (except the targets are wide, because the REX prefix tells us so). Finally, 44 represents eax*2, which would be a 64-bit wide field.

The exact addressing mode used here is pretty complicated, but safe to say that common ones can quickly be worked out. For example, the 32-bit equivalent (mov eax, [esp+4]) is the 4-byte 8B 44 24 04.

Upvotes: 0

Related Questions