5

I'm currently trying to write a disassembler. I found the following list of opcodes and their meanings, so i decided to parse it at runtime: http://web.archive.org/web/20150810224114/http://mprolab.teipir.gr/vivlio80X86/pentium.txt

But i am stuck at the opcode 0x00: It is followed by a reg/modbyte. Parsing it was not much of a problem for me.

But I'm having trouble with the Scale-Index-Base byte:
If you actually specify esp as index register, it actually means that there is no index register.

The same applies for the base register with ebp. But I've tried it with C++ inline assembler: It is possible to compile: add [ebp*2+ebp],cl

So how can ebp be used as base register when using ebp as base register actually means using no base register at all!?

Nfff3
  • 321
  • 8
  • 24
Zotta
  • 2,513
  • 1
  • 21
  • 27
  • 1
    Just a small naming correction. `SIB` stands for "[Scale-Index-Base](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf)", named according to its bitmask encoding in the SIB byte: 0`ssiiibbb`b (bitwise). – ahmd0 May 12 '18 at 18:56
  • 1
    Near duplicate of [rbp not allowed as SIB base?](https://stackoverflow.com/q/52522544) - `[EBP]` is encoded as `[ebp + disp8=0]` – Peter Cordes May 24 '20 at 19:53

1 Answers1

9

The "missing EBP" case apply only in case ModR/M.Mod field has value 00 binary. If you need EBP as a base, the assembler changes the Mod to 01 binary and adds 8-bit displacement with value of zero:

004C6D00 add [ebp+ebp*2], cl

tbodt
  • 16,609
  • 6
  • 58
  • 83
MazeGen
  • 106
  • 1
  • Ok are there other missing registers for 8bit and 32bit displacement values then? Any other strange inordinatenesses? – Zotta Aug 13 '10 at 13:33
  • 2
    Only EBP is "missing". Note that you can encode pure [displacement] addresing because of "missing ESP index" and "missing EBP base" two ways: 000D 78563412 add [12345678], cl 000C25 78563412 add [12345678], cl However, in 64-bit mode, the first opcode means: 000D 78563412 add [rip+12345678], cl EDIT: shit, line breaks were eaten what makes the comment less readable. – MazeGen Aug 13 '10 at 13:46