Log in

View Full Version : a wrong disassembly?


dion
August 20th, 2002, 03:38
i'm confused who is wrong, is it wrong disassembly or ida. i'm seeing lot of db 66h occurances. examples:

push ebx
mov ax, 30h
db 66h
mov ds, ax
assume ds:nothing
mov eax, [ebp+arg_C]

mov ax, 30h
db 66h
mov ds, ax
assume es:nothing
db 66h
mov es, ax
db 66h
mov fs, ax
db 66h
mov gs, ax

but strangely, i dont see this db 66h in hiew. anyone knows who is wrong? if ida is wrong, then how to fix it?
thanks

comrade
August 20th, 2002, 04:22
Perhaps IDA is dissassembling in 16-bit mode when the code is 32-bit?

username
August 20th, 2002, 17:44
Quote:
Originally posted by dion
but strangely, i dont see this db 66h in hiew. anyone knows who is wrong? if ida is wrong, then how to fix it?
thanks

Neither is wrong, the difference in the disassembly is the result of the treatment of the Operand Size override between HIEW/IDA, they both represent the same code (byte sequence).

dion
August 21st, 2002, 03:22
thanks username.
accidentally, i read a source code file in 98ddk pack, a file named drv2.c, which is have strange and have same 66h value. the listing is:

_asm
{
_emit 66h _asm push si ; push esi
_emit 66h _asm push di ; push edi
_emit 66h _asm mov ax,word ptr function ;eax = function
_emit 66h _asm mov bx,word ptr dev ;ebx = device
_emit 66h _asm mov cx,word ptr buffer_size ;ecx = buffer_size
_emit 66h _asm mov dx,word ptr flags ;edx = flags
_emit 66h _asm xor di,di ; HIWORD(edi)=0
les di,buffer
mov si,es ;si=es
call dword ptr VDDEntryPoint ;call the VDD's PM API
cmp ax,word ptr function
je fail
_emit 66h _asm mov word ptr result,ax
fail: _emit 66h _asm pop di ; pop edi
_emit 66h _asm pop si ; pop esi
}

mmm... what u mean with operand size override, username? then do u know how to fix it in ida?

username
August 21st, 2002, 10:05
Quote:
Originally posted by dion
mmm... what u mean with operand size override, username?

First of all, you should download the Intel manuals from http://developer.intel.com/design/pentium4/manuals/ and then read at least chapter 3 (more precisely 3.6) in the first volume.
Quote:
then do u know how to fix it in ida?

What do you want to 'fix'? IDA behaves correctly as well as i indicated already. If you want to change the visual representation of such instructions then you can turn on PC_ANALYSE_NOPREF in your ida.cfg (or better, idauser.cfg), but this works only for IDA 4.16 and up.

dion
August 22nd, 2002, 03:24
wee... thanks username