How are hex sequence translated to assembly without ambiguity?

前端 未结 9 2131
忘了有多久
忘了有多久 2021-01-06 14:59
8B EC 56 8B F4 68 00 70 40 00 FF 15 BC 82 40   

A senquence like above can be segmented in various ways,each segment can be translated to correspon

9条回答
  •  情深已故
    2021-01-06 15:37

    It sounds like the answer to your question is the somewhat flippant "Know your starting point", but maybe you want something a little more verbose. Given your string:

    8B EC 56 8B F4 68 00 70 40 00 FF 15 BC 82 40
    

    AND a starting point (Let's say the 8B is your starting point) there is only one possible interpretation of the bytes.

    So let's say one operation is 8B EC 56 8B (Depending on your operation length, etc), then the NEXT operation is F4 68... In this case, it's impossible for the machine to try to interpret an operation 56 8B F4 68 because no operation ended at just that point.

    Now, if your start point was the 56, then you can get that group but cannot get either of the ones mentioned previously.

    The layout of your memory is very specific and start points/jump points are exact and unforgiving--they are required as surely as the code itself.

提交回复
热议问题