Author Topic: Please explain NDISASM output  (Read 15952 times)

nobody

  • Guest
Please explain NDISASM output
« on: October 06, 2006, 04:49:15 PM »
Would someone please explain what the part in quotations represents.

Address    ??????             Instruction
000011BC  "8B45EC"            mov ax,[di-0x14]

Is this the label of that particular section of code? Thanks in advance.

nobody

  • Guest
Re: Please explain NDISASM output
« Reply #1 on: October 06, 2006, 06:05:49 PM »
8B 45 EC is the sequence of bytes (opcode and operands) representing "mov ax, [di - 0x14]". Simple as that. Labels don't show, as such, in disassembled output (unfortunately!!!). If we had "mov dx, msg", we'd see, in the disassembled output, "address" (this can and should be adjusted to the actual address the code will be run at with the "-o" switch to ndisasm - e.g. ndisasm -o 0x100 somefile.com), "the bytes" (what you're asking about), and "the instruction" that "the bytes" disassemble into.

0000100 BA0801 mov dx, 0x108

Note that jmp, jcc, and call use "relative addressing". We write "jmp short mylabel", and it disassembles as "jmp short 0x????" (the address of mylabel), but "the bytes" will show EB <*distance", plus or minus, to mylabel>.

The ndisasm manual was included as a separate document in 0.96 (or 0.95?) distributions, but got lost in 0.97 and 0.98. Currently, it's part of the main Nasm manual, so it shouldn't get lost again. Check that out for more info.

Best,
Frank

nobody

  • Guest
Re: Please explain NDISASM output
« Reply #2 on: October 06, 2006, 06:20:47 PM »
And the lightbulb goes on.  Thanks a lot Frank.