View Full Version : a wrong disassembly?
dion
August 20th, 2002, 03:38
i'm confused who is wrong, is it wrong disassembly or ida. i'm seeing lot of db 66h occurances. examples:
push ebx
mov ax, 30h
db 66h
mov ds, ax
assume ds:nothing
mov eax, [ebp+arg_C]
mov ax, 30h
db 66h
mov ds, ax
assume es:nothing
db 66h
mov es, ax
db 66h
mov fs, ax
db 66h
mov gs, ax
but strangely, i dont see this db 66h in hiew. anyone knows who is wrong? if ida is wrong, then how to fix it?
thanks
comrade
August 20th, 2002, 04:22
Perhaps IDA is dissassembling in 16-bit mode when the code is 32-bit?
username
August 20th, 2002, 17:44
Quote:
Originally posted by dion
but strangely, i dont see this db 66h in hiew. anyone knows who is wrong? if ida is wrong, then how to fix it?
thanks |
Neither is wrong, the difference in the disassembly is the result of the treatment of the Operand Size override between HIEW/IDA, they both represent the same code (byte sequence).
dion
August 21st, 2002, 03:22
thanks username.
accidentally, i read a source code file in 98ddk pack, a file named drv2.c, which is have strange and have same 66h value. the listing is:
_asm
{
_emit 66h _asm push si ; push esi
_emit 66h _asm push di ; push edi
_emit 66h _asm mov ax,word ptr function ;eax = function
_emit 66h _asm mov bx,word ptr dev ;ebx = device
_emit 66h _asm mov cx,word ptr buffer_size ;ecx = buffer_size
_emit 66h _asm mov dx,word ptr flags ;edx = flags
_emit 66h _asm xor di,di ; HIWORD(edi)=0
les di,buffer
mov si,es ;si=es
call dword ptr VDDEntryPoint ;call the VDD's PM API
cmp ax,word ptr function
je fail
_emit 66h _asm mov word ptr result,ax
fail: _emit 66h _asm pop di ; pop edi
_emit 66h _asm pop si ; pop esi
}
mmm... what u mean with operand size override, username? then do u know how to fix it in ida?
username
August 21st, 2002, 10:05
Quote:
Originally posted by dion
mmm... what u mean with operand size override, username? |
First of all, you should download the Intel manuals from http://developer.intel.com/design/pentium4/manuals/ and then read at least chapter 3 (more precisely 3.6) in the first volume.
Quote:
then do u know how to fix it in ida? |
What do you want to 'fix'? IDA behaves correctly as well as i indicated already. If you want to change the visual representation of such instructions then you can turn on PC_ANALYSE_NOPREF in your ida.cfg (or better, idauser.cfg), but this works only for IDA 4.16 and up.
dion
August 22nd, 2002, 03:24
wee... thanks username

Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.