How are hex sequence translated to assembly without ambiguity?

前端 未结 9 2133
忘了有多久
忘了有多久 2021-01-06 14:59
8B EC 56 8B F4 68 00 70 40 00 FF 15 BC 82 40   

A senquence like above can be segmented in various ways,each segment can be translated to correspon

9条回答
  •  醉酒成梦
    2021-01-06 15:39

    If you open a binary in a hex editor, copy a portion of data and paste in a disassembler, you will very probably not copy a complete instruction. Let's use your example.. in a Windows XP 32bits SP3 English, if I assembly 8B EC 56 8B F4 68 00 70 40 00 FF 15 BC 82 40 I'll get:

    Hex dump          Command
    8BEC              mov ebp,esp
    56                push esi
    8BF4              mov esi,esp
    68 00704000       push 407000
    FF15 BC824000     call dword ptr ds:[4082bc]
    

    As you can see it assembled completely different then the answer of the other guys below...

    Now let's pretend that instead of assembling 8B EC 56 8B F4 68 00 70 40 00 FF 15 BC 82 40
    you added C0 opcode at the beginning C0 8B EC 56 8B F4 68 00 70 40 00 FF 15 BC 82 40

    Now check below what a single byte did in our instructions:

    Hex dump             Command
    C08B EC568BF4 68     ror byte ptr ds:[ebx+f48b56ec],68
    0070 40              add byte ptr ds:[eax+40],dh
    00FF                 add bh,bh
    15 BC824000          adc eax,4082bc
    

    As you can see it was completely modified!

    The processor know where to start and what arguments to the instruction to take by the opcode instruction. In the first example our first opcode was 8B so it knows that it can be followed by another byte. If this byte is EC so the instruction ends here, and it means mov ebp, esp.

    In our second example it start with C0 and it can be followed by another byte, meaning another instruction. Then C08B is the instruction, and EC568BF4 68 is the argument.

    Imagine that inside the processor has a huge (but nano) circuit, that behave like a chain of ifs (conditions), that depending on the value of the hexcode (or opcode) it knows "where to go" or "how to behave".

提交回复
热议问题