0

  1. How to calculate x86 code mov offset(machine code)? please also give an example !!

  2. I want to input full address. Anyway make it possible? Address: 7FFB4AB12910, I want something like this: 48 8B 0D 352047A4B4FF07

7FFB4A0A0003 - 48 8B 0D 0629A700     mov rcx,[7FFB4AB12910]
phuclv
  • 37,963
  • 15
  • 156
  • 475
Chris
  • 1
  • 3
  • 1
    I do not understand what you mean by “calculate mov offset.” Can you explain what you need in detail? Note that no standard addressing mode supports a 64 bit displacement. Either load the address into a register first, or use the `mov rax, moff64` opcode for this purpose (e.g. `mov rax, [7FFB4AB12910]`). This instruction can only be used with the A register (`al/ax/eax/rax`). – fuz Apr 18 '21 at 11:32
  • @fuz 1.sorry!! it is "calculate the offset of code mov ". – Chris Apr 18 '21 at 12:12
  • @fuz 2. 7FFB4AB12910 - 7FFB4A0A0003 = A7290D. It does not match the offset(A72906). any thing wrong? – Chris Apr 18 '21 at 12:17
  • 1
    Recall that the offset is computed relative to the beginning of the next instruction. Also note that x86 instructions are encoded in little endian, so `06 29 A7 00` is `0x00A72906`. If you account for these two things, you'll see that the instruction is encoded correctly. – fuz Apr 18 '21 at 12:18
  • Thanks you so much. I would like ask one more question that how to calculate the size of instruction in assembly? – Chris Apr 18 '21 at 12:30
  • 1
    For x86, this is challenging. You basically have to decode the instruction completely to find out how long it is. Use a library like libcapstone if possible. There are some questions on this subject on this site, but they all boil down to “good luck.” – fuz Apr 18 '21 at 12:32
  • For example, check [this answer](https://stackoverflow.com/a/45802339/417501). – fuz Apr 18 '21 at 12:34

0 Answers0