x86 machine code 初探 (4) - mov immediate

一樣用例子來說明, 這次來解讀 mov immediate, L10 ~ L12：

address_mode.S

 1 # practice x86 machine code
 2 #.code16
 3 .code32
 4 .text
 5 .global begin
 6 begin:
 7 #  add 0x12345678(%eax, %esi, 4), %esi
 8 #  add 0x12(%bx, %si, 2), %si
 9 #  mov  0x1234,%esi 
10   movl  $5, (%ebx)
11   movb  $5, (%ebx)
12   mov  $5, %ebx

objdump -d address_mode.elf

 1 descent@w-linux:x86_machine_code$ objdump -d address_mode.elf 
 2 address_mode.elf:     file format elf32-i386
 3 
 4 
 5 Disassembly of section .text:
 6 
 7 00000100 <_text>:
 8  100:   c7 03 05 00 00 00       movl   $0x5,(%ebx)
 9  106:   c6 03 05                movb   $0x5,(%ebx)
10  109:   bb 05 00 00 00          mov    $0x5,%ebx

ref:
Intel_64 and IA-32 Architectures Software Developer’s Manual Combined Volumes: 1, 2A, 2B, 2C, 3A, 3B and 3C
page
Vol. 2C B-36/B-37

這個表有 non-64 bit 和 64 bit mode 的分別
MOV – Move Data

#0 immediate to register 1100 011w : 11 000 reg : immediate data
#1 immediate to register (alternate encoding) 1011 w reg : immediate data
#2 immediate to memory 1100 011w : mod 000 r/m : immediate data

intel machine code 果然複雜, 越新的手冊內容越多, 密密麻麻的欄位看得令人頭皮發麻。這次來看看 opcode 欄位裡頭的 w bit:

B.1.4 Special Fields
Table B-1 lists bit fields that appear in certain instructions, sometimes within the opcode bytes. All of these fields (except the d bit) occur in the general-purpose instruction formats in Table B-13. Table B-1. Special Fields Within Instruction Encodings

w Specifies if data is byte or full-sized, where full-sized is 16 or 32 bits (see Table B-6)  1   

Table B-6. Encoding of Operand Size (w) Bit

w Bit	Operand Size When Operand-Size Attribute is 16 Bits	Operand Size When Operand-Size Attribute is 32 Bits
0	8 Bits	8 Bits
1	16 Bits	32 Bits

有了這兩個資訊, 我們就可以解讀 mov 的 machine code。

先來看 address_mode.S L 10:
movl $0x5,(%ebx)
c7 03 05 00 00 00

c7 -> Ev,Iv 這裡應該是指 Ev
03 is modrm
modrm -> 2:3:3
mod: 00
reg: 000
r/m: 011
符合 #2 1100 011w : mode 000 r/m : imm
所以 05 00 00 00 is imm
w 為 1, 所以 opcode 是 c7。

mod:00 r/m:011 => [ebx]

再來看看

11   movb  $5, (%ebx)

machine code: c6 03 05
對照這些表格資料, 應該可以知道為什麼是 opcde: c6, imm: 05 (提示: w=0)

再看

12   mov  $5, %ebx

machine code: bb 05 00 00 00
這次要對照 #1
1011
w: 1
reg: 011 -> ebx
imm: 05 00 00 00
所以得到 bb 05 00 00 00

真辛苦, 又完成一次人工解讀。