1

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 enter image description here

Try to understand why is 85c0 with this table: enter image description here

85 comes from 'test', ok. But c0 from EB lb? I'm a little confused how to create that opcode and how to modify and get test eax, 1.

Thanks, appreciate any help!

  • This table shows only the first byte. There has to be more on that page that allows to say what are the next bytes. – Paweł Łukasik Jul 22 at 5:09
  • Thanks for the answer. Great explanation @bart1e algo the page, it helps a lot!:) – felix89 Jul 22 at 8:19
4

The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1.

The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example using nasm and then objdump or simply this site) - this way you don't have to remember anything about the opcodes which are sometimes weird.

However, you want to patch 2 bytes instruction and the opcode I gave is 5 bytes. As a workaround, you can do test al, 1 (a8 01), which will do the same (will do test only on the least significant byte of eax).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.