What syntax does OllyDbg follow in its dissassembly window?

Question

I have some understanding of Assembly after reading some tutorials and a few chapters from the "PC Assembly Book". Right now, I am trying to understand the instructions I see in OllyDbg, but it seems to follow a different syntax than the NASM syntax I am used to.

This OllyDbg instruction for example doesn't seem intuitive to me, especially the PTR SS: part.

MOV DWORD PTR SS:[ESP+8],EBX

I am not looking for an explanation of this particular construct, but rather a documentation for the whole syntax. How can I find that?

Answer 1

OllyDbg uses the MASM/Intel syntax for disassembly. You can get the basic documentation at http://www.cs.virginia.edu/~evans/cs216/guides/x86.html. The Intel developer manuals can give you more detail about what specific instructions do and what segments mean (in your case the memory location [ESP+8] uses the SS segment).

On Windows user mode it is safe to ignore all segments (SS:[ESP+8] means exactly the same as DS:[ESP+8]), only the FS (32 bit) and GS (64 bit) segments have a meaning. See this page for more information.

A good resource is Basics of Assembler by Lena151 it should get you up to speed if you're not familiar with (dis)assembly. In x64dbg you can get brief descriptions and the relevant intel manual section for every instruction with a click of the mouse which might come in handy too.