Skip to main content
15 events
when toggle format what by license comment
Jul 19, 2022 at 11:54 comment added user52174 thanks found that in the book The X86 Microprocessors: Architecture And Programming (8086 To Pentium) as well. good to know for my studies of basics of how CPU works. thanks very much for help.
Jul 19, 2022 at 11:39 comment added Criticizing Israel not allowed @user52174 Every byte has a separate address.
Jul 19, 2022 at 11:21 comment added user52174 from your comment on my follow up question (to clear out what the misunderstanding was), I see now what it is. we are talking about different things. you use MOV eax, next 4 bytes from EIP as an analogy for what B8 44 33 22 11 does. I was talking about a more literal example, and I still do not think my literal one would work. thank you for your comments and answer that helped me understand a lot more.
Jul 19, 2022 at 11:13 comment added user52174 I have a hard time seeing 8B01 would increment PC twice, since it is just 16 bit, and each word is 16 bit in x86 architecture if I understand. If it did increment by 2, what about the next instruction that is skipped?
Jul 19, 2022 at 11:11 comment added user52174 Yes mov EAX, [ECX] is 8B01. mov EAX, [ECX++] is not allowed, and you cheery pick the actual machine code for instructions that are real, to make a case for non real ones. You may be right that mov EAX, [EIP] would somehow skip over multiple follow instructions and be able to get data crammed into that address, but it does not add up to me. The other part, how a mov instruction can do things over many words, does.
Jul 19, 2022 at 10:58 comment added Criticizing Israel not allowed @user52174 no, "mov EAX, [ECX]" (8B 01) does not increment the program counter 4 times. It increments the program counter twice. Different instructions are different.
Jul 19, 2022 at 10:52 comment added user52174 That seems false to me. "mov EAX, [ECX]" if I understand copies the data in RAM at the address in ECX register, and moves it to EAX register. if it also increments program counter multiple times like 4 times, how could a program read in the next instruction if it skips it? I have no problem understanding the normal mov instruction example, I just do not see or agree with the "weird" case of it that we are talking about.
Jul 19, 2022 at 10:47 comment added Criticizing Israel not allowed @user52174 The byte B8 tells the CPU to increment the program counter by 1, copy 4 bytes from the program counter address to EAX, then increment the program counter by 4.
Jul 18, 2022 at 23:44 comment added user52174 And that seems false to me. You skip over details. Specifically, the bytes B8 44 33 22 11 also tell the program counter to hop two times (I assume, is this true? ) mov EAX, [address] does not increment program counter in the way that it could fetch the word following that instruction. you are not making any point when you make false analogies. I already know computers executive machine instructions, so not sure what the point is supposed to be. "you could literally do this, hypothetically, except you could not", not a very good point.
Jul 18, 2022 at 23:10 comment added Criticizing Israel not allowed @user52174 I'm trying to make the point that the byte B8 is totally indistinguishable from an instruction called mov EAX, [EIP++] or mov EAX, next 4 bytes from EIP. Since that instruction isn't actually in the manuals, we have to make up a name for it. If you really wanted, you could make an assembler where the instruction mov EAX, [EIP++] translates to B8
Jul 18, 2022 at 22:40 comment added user52174 You are the one who mentioned "hypothetical" incrementing EIP, "there is literally no difference between "mov EAX, 0x11223344" and (hypothetically) "mov EAX, [EIP++]" followed by 0x11223344. They make the exact same bytes of machine code and do exactly the same thing". Now you deleted that, but as I said, it does not at all seem to be "exact same machine code", that seems to be a false statement. Thank you for your comments overall, has been helpful.
Jul 18, 2022 at 22:24 comment added Criticizing Israel not allowed @user52174 There is no "MOV eax, next 4 bytes from EDX" instruction. If there was, it would increment EDX by 4 bytes, not EIP. Some architectures do have this type of instruction.
Jul 18, 2022 at 22:22 comment added user52174 I've tested it as far as I could in x86 emulators now, and it does not seem possible to do MOV eax, [EIP] with the number after that as its own "instruction" and get exact same machine code as MOV eax, number. It only increments the program counter by one, so it would not make sense. And getting the value for the instruction pointer seems a bit tricky as well, to start with.
Jul 18, 2022 at 18:18 comment added user52174 Thanks. But, I still do not think "MOV eax, next 4 bytes from EDX" seems like it would increment the program counter an extra step (and skip over the next instruction that might be 0x11223344. ) So I still do not see that "MOV eax, next 4 bytes from EIP" would (and then jump directly to the instruction after "0x11223344". ) And if it does not, then it can't be exact same machine code bytes. I might be missing something, this is my thoughts at the moment.
Jul 18, 2022 at 17:46 history answered Criticizing Israel not allowed CC BY-SA 4.0