Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

x86 Modrm/Sib/Displacement bytes for opcode '89'

I'm developing a disassembler for the 32-bit x86 instruction set. My code currently decodes most 1 and 2 byte opcodes correctly, but I have run into a problem. When I compare the output of my code to Objdump, I find that Objdump sees the following:-

89 14 98                mov    %edx,(%eax,%ebx,4)

8b 45 d8                mov    -0x28(%ebp),%eax

On the other hand, my code gives:-

89 14 98 8B 45 D8 89   MOV.

From my understanding of Intels documentation (The Modrm and Sib addressing form tables in particular), this byte stream should be interpreted as:-

89 - The opcode
14 - The Modrm byte
98 - The Sib byte specified by the Modrm byte (as shown in Intels Modrm addressing table)
8B 45 D8 89 - The four byte displacement specified by the Sib byte (as shown in Intels Sib addressing table).

Objdump says that there are no displacement bytes, but both my code and Intels documentation appear (to me at least) to say otherwise.

If anyone could point out where my error is, it would be much appreciated.

Thanks.

like image 337
rick Avatar asked Aug 20 '12 21:08

rick


People also ask

What is Modrm byte?

The ModR/M byte is a part of an instruction used when a memory operand is required (used). It permit to specify: the location of the first operand (address mode or register) and. the location of the second operand (a register) if required by the instruction.

How many bytes is each instruction in x86?

General Overview. An x86-64 instruction may be at most 15 bytes in length.

What is SIB in x86?

The size bit in the opcode specifies 8 or 32-bit register size. To select a 16-bit register requires a prefix byte. The so-called scaled indexed addressing modes, SIB = scaled index byte mode. Note that there is no [ ebp ] addressing. It's slot is occupied by the 32-bit displacement only addressing mode.


1 Answers

The Mod/RM byte 0x14 breaks down into Mod=00 Reg=010 R/M=100.

In http://download.intel.com/design/intarch/manuals/24319101.pdf Table 2-2 (page labeled "2-6", actually page 36 of the PDF) it shows Mod=00 R/M=100 as being a SIB with no displacement.

I can't be sure which part you've misread since you didn't specify the documentation you're using. There are lots of different Intel manuals.

like image 151
Alan Curry Avatar answered Oct 16 '22 12:10

Alan Curry