2 Replies - 201 Views - Last Post: 10 February 2014 - 12:12 PM

#1 Gisengryl  Icon User is offline

  • D.I.C Head

Reputation: 0
  • View blog
  • Posts: 125
  • Joined: 08-September 12

How to know which byte in a Hex editor represents which instruction ?

Posted 09 February 2014 - 04:18 AM

As titled.

I assembled and linked a .asm file using TASM and TLINK.

Afterwards, I used HxD as the hex editor to view the resultant .exe file.

How do I figure out which hex value shown in HxD represents which instruction (such as MOV ) ?

Thanks,
A very confused person.
Is This A Good Question/Topic? 0
  • +

Replies To: How to know which byte in a Hex editor represents which instruction ?

#2 GunnerInc  Icon User is online

  • "Hurry up and wait"
  • member icon




Reputation: 858
  • View blog
  • Posts: 2,277
  • Joined: 28-March 11

Re: How to know which byte in a Hex editor represents which instruction ?

Posted 09 February 2014 - 09:09 PM

Read the documentation! Intel and AMD both have documents describing each instruction and its corresponding opcode.

Here is a sample I whipped up. Source is on the left, the hex of the exe is on top and disassembly in a debugger on the bottom.

Attached Image

I do 64bit now, but the opcodes will be more confusing, so this example is 32 bit. by TASM, I am assuming 16bit? Just search for 16bit opcodes.

I added an int 3 as the first line of code, since it is easier to search for that in the hex editor since there is other stuff in an exe.
Was This Post Helpful? 0
  • +
  • -

#3 turboscrew  Icon User is offline

  • D.I.C Addict

Reputation: 100
  • View blog
  • Posts: 615
  • Joined: 03-April 12

Re: How to know which byte in a Hex editor represents which instruction ?

Posted 10 February 2014 - 12:12 PM

Very nice!
Was This Post Helpful? 0
  • +
  • -

Page 1 of 1