intel machine code to assembly code question.

Question

hello,experts,i wonder the intel x86 machineCode/assemblyCode conversion is singleSide or bothSide?

means: assemblyCode ---> machineCode and machineCode ---> assemblyCode are both available.

since the x86 machineCode is vary in size (1-15 byte),and opcode vary in (1-3 byte),how to determine one opcode is 1byte or 2byte or 3byte ?

and i never found the example of prefix of x86 instructions,if here is 1byte prefix,how to determine it is prefix or opcode?

certainly, the assemblyCode ---> machineCode , the identity of mnemonics + oprand[w/b] can determine what the response machineCode is by maping certain MappingTable.

but,when the process is reversed:

{ bbbbbbbb,bbbbbbbb,bbbbbbbb, //instruction1 bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,//instruction2 bbbbbbbb,bbbbbbbb//instruction3 }

----> {bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb,bbbbbbbb}

i don't know which is the significant bits or byts to determined how long(what size) one instruction is.

would any one tells me how to determine that?(the size of opcode,the prefix example.) thanks for help.

Answer 1

Not sure what you want to accomplish, but since the instructions have variable length the only way to be sure you get back the correctly disassembled code is to start from a known start address. Usually disassemblers start from the starting point of the program and then recursively disassemble all methods called.

However this leads to situations where some code chunks are not disassembled because they can be called from a function table or similar situations, so it needs help from a human usually to see if the remaining sections are code or data.

Answer 2

since the x86 machineCode is vary in size (1-15 byte),and opcode vary in (1-3 byte),how to determine one opcode is 1byte or 2byte or 3byte?

The size of the instructed is implicitly defined by instruction and address mode, you will have to check the ISA one byte at a time what can and should follow said byte.

and i never found the example of prefix of x86 instructions,if here is 1byte prefix,how to determine it is prefix or opcode?

For example, the operand size override prefix (66h) is always a prefix.

Answer 3

The details you need are in Intel® 64 and IA-32 ArchitecturesSoftware Developer’s Manual Volume 2B: Instruction Set Reference, N-Z. Look at Appendix A, it includes everything you need.