1

I am a bit confused about the CFF explorer quick disassembler options shown in my screen , Can somebody explain what those hex values are underneath the Opcode part ?

enter image description here enter image description here enter image description here

updated the question part , there is no confusion in the first two pictures , Its just the last pic with the show opcode part that is confusing me .

How do I know the bytes corresponding to an instruction in Hex view in IDA?

enter image description here

Why would i want to know about the "number of opcode bytes" ?

Improve this question
4
  • the english form is for us humans computers can understand only 83 ec 1c and cannot understand sub esp,1c the hex is for computers and teh sub esp,1c is the meaning of that hex bytes and it was interpreted by the disassembler from the hex bytes when you open any file in hex editor you can only see hex you cannot see the mnemonics anywhere
    – blabb
    Commented May 3, 2018 at 19:17
  • updated the question a bit , maybe now this question makes more sense .
    – KpaK
    Commented May 4, 2018 at 0:18
  • When you assemble an instruction the linker translate it to an opcode for the machine to understand (hex bytes). When disassembling we already have the assembled file as an opcodes so what the disassembler do is reverse it to a readable form e.g 83EC1C => sub esp, 0x1c, the disassembler doesn't actually change anything in the file it just shows you the translation which is the assembly language instructions.
    – Cyb3r
    Commented May 4, 2018 at 1:15
  • your original query and the edited one differs a lot in scope first you asked what is the hex bytes now you are asking about the number of hexbytes both are very different the setting possibly exists to show only a limited amount of bytes x86 instruction set is a variable length instruction set it varies from 1 hexbyte to 15 hexbyte max with that setting at 6 if an instruction has more than 6 hexbytes they would be truncated from display (only in display )
    – blabb
    Commented May 4, 2018 at 11:24

1 Answer 1

Reset to default
0

x86 (ISA) Instruction Set Architecture is a variable length primarily CISC design 

CISC is complex instruction set computing   
RISC is Reduced instruction set computing

the x86 ISA can encode operations between 1 byte to 15 bytes max

the human readable form of encoding is called mnemonic
example for mnemonics are nop, int 3 , push eax etc

the machine readable form is binary (0,1)
usually encoded as a BYTE (8 bit) between 0x00 and 0xFF
(00000000 to 11111111) or between 20 -1 and 28 -1 these bytes are termed opcodes (the hex bytes you see in display)

  1. Single Byte Encoded Operation examples
    mnem= mnemonic , enco= Encoding

mnem      |enco        |
         nop |       0x90 |
        int 3 |       0xcc |
push eax |       0x50 |

  1. Two Byte Encoded Operation examples
    mnem= mnemonic , enco= Encoding

mnem            |enco        |
mov ebp,esp |  0x8BEC |

A 12 byte Encoded Operation

>>> for i in range( len(ks.asm(CODE)[0])):
...     print (hex(ks.asm(CODE)[0][i])),
...
0xf0 0x81 0x84 0x4e 0x67 0x45 0x23 0x1 0xef 0xcd 0xab 0x89
>>> print CODE
LOCK ADD DWORD PTR DS:[ESI+ECX*2+0x1234567], 0x89ABCDEF

the setting 6 you have circled in you screen shot limits the number of displayed opcodes to a maximum of 6 bytes only so in the last instruction above you will only see a display of

0xf0 0x81 0x84 0x4e 0x67 0x45 and not all of the 12 bytes

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.