News:

MASM32 SDK Description, downloads and other helpful links
MASM32.com New Forum Link
masmforum WebSite

an example for debug

Started by applechu, March 05, 2012, 12:08:50 PM

Previous topic - Next topic

applechu

Hi:
I recently try the masm program, and using command DEBUG to trace each instruction.
But I have confused about some result as following:



-t

..........................  CX=0048  DX=0000  SP=0400  BP=0000  ......
DS=0B41  ES=0B41  SS=0B56  CS=0B51  IP=0002   NV UP EI PL NZ NA PO NC
0B51:0002 B92000        MOV     CX,0020
-t

AX=0010  BX=0000  CX=0020  DX=0000  SP=0400  BP=0000 ......
DS=0B41  ES=0B41  SS=0B56  CS=0B51  IP=0005   NV UP EI PL NZ NA PO NC
0B51:0005 E80800        CALL    0010
-t

..............  CX=0020  DX=0000  SP=03FE  BP=0000  .....
DS=0B41  ES=0B41  SS=0B56  CS=0B51  IP=0010   NV UP EI PL NZ NA PO NC
0B51:0010 53            PUSH    BX



The problem is what is the meaning  the address 0B51:0010 attach 53.
Thanks.





MichaelW

The first number group following the segment:offset address is the encoded instruction.

In case you are not already aware of this, all numbers in DEBUG are hexadecimal.

For the MOV CX, 0020 the B9 is the opcode and the 2000 is a 16-bit immediate value. The reason for 0020 being encoded as 2000 is that the x86 is a little-endian machine where multi-byte items stored in memory are stored with the least-significant byte first (where "first" means at the lowest address).

For the CALL 0010 the E8 is the opcode and the 0800 is a 16-bit displacement, a signed value that added to the offset address of the next instruction (the PUSH BX in this case) to produce the destination offset address (0008h + 0008h = 0010h).

For the PUSH BX the 53 is the opcode.
eschew obfuscation

mineiro

Quote from: applechu on March 05, 2012, 12:08:50 PM

-t
CX=0048h  SP=0400h
????:0002 B92000        MOV     CX,0020h
seg :offs opcode        mnemonic
--->you are in ????:0002h and that instruction have 3 bytes of size;
--->so, 0002h+3bytes = 0005h, exactly the next offsset(address)
-t
SP=0400
????:0005 E80800        CALL    0010h
---> this is a call instruction, it push in stack(change sp) the next address (0005h+3bytes)
---> and after do a jmp to 0010h, this is why you do not reach offset 0008h (????:0008h)
-t
SP=03FE
????:0010 53            PUSH    BX
---> this address have an opcode 53, their size is one byte, so
---> the next instruction will be 0010h+1byte = 0011h
????:0011

I'm assuming same segment.

Rockphorr

Quote from: mineiro on March 05, 2012, 02:25:50 PM
Quote from: applechu on March 05, 2012, 12:08:50 PM

-t
CX=0048h  SP=0400h
????:0002 B92000        MOV     CX,0020h
seg :offs opcode        mnemonic
--->you are in ????:0002h and that instruction have 3 bytes of size;
--->so, 0002h+3bytes = 0005h, exactly the next offsset(address)
-t
SP=0400
????:0005 E80800        CALL    0010h
---> this is a call instruction, it push in stack(change sp) the next address (0005h+3bytes)
---> and after do a jmp to 0010h, this is why you do not reach offset 0008h (????:0008h)
-t
SP=03FE
????:0010 53            PUSH    BX
---> this address have an opcode 53, their size is one byte, so
---> the next instruction will be 0010h+1byte = 0011h
????:0011

I'm assuming same segment.

all right
Strike while the iron is hot - Бей утюгом, пока он горячий

applechu