Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What does data16 mean in objdump output?

Using the objdump command:

$ objdump -M att -d  wrapping_counters_test   

I produced this listing (this is just a snippet from the entire listing):

100000ae5:   31 ed                   xor    %ebp,%ebp
100000ae7:   31 d2                   xor    %edx,%edx
100000ae9:   49 89 c4                mov    %rax,%r12
100000aec:   b8 00 ca 9a 3b          mov    $0x3b9aca00,%eax
100000af1:   66 66 66 66 66 66 2e    data16 data16 data16 data16 data16 nopw %cs:0x0(%rax,%rax,1)
100000af8:   0f 1f 84 00 00 00 00
100000aff:   00
100000b00:   8d 75 01                lea    0x1(%rbp),%esi

What does the line of data16s following the 2nd mov instruction mean?

like image 417
Doug Richardson Avatar asked Apr 19 '16 00:04

Doug Richardson


1 Answers

That's just a multi-byte nop inserted for alignment padding. Notice how the last line is at address 100000b00 which is 16 byte aligned. data16 itself is an operand size override prefix. Normally only one is used and it's not disassembled separately, but included in the instruction suffix. You can see you have six 66 instances but only five data16 appear, the sixth is the w in the nopw and you normally only get that. Only the extra prefixes inserted to lengthen the instruction are shown separately.

like image 79
Jester Avatar answered Oct 15 '22 14:10

Jester