0

I'm reverse engineering a bootloader using IDA. When I use "patching" plugin to reassemble the file, the machine code it produced is different comparing to the code of the same instruction found in disassemble result.

What caused this phenomenon.

The segment info picture

The plugin GUI when I use

This is the code the plugin produced

00000008 | 01 D8 | add ax, bx

This is the code found in original file

0000000C | 03 C3 | add ax, bx

After discovering that, I substitute '03 C3' with '01 D8' and debug it. both of them works.

What's the difference?

Does the instruction set of intel is not the one-to-one relationship?

REBeast
  • 1
  • 1
  • Indeed it's not one to one. They differ in which operand can be memory. If you use two registers then you can use either one. – Jester Jan 12 '23 at 13:25

0 Answers0