0

Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of instruction using say ollydbg or immunity debugger??

I am very new to this and I do not want to use a disassembly library like Minhook and Microsoft Detours. Just something done manually.

  • can you rephrase Your question ollydbg shows the opcodes for each instruction also it shows the address of current instruction and address of next instruction either count the opcode bytes or subtract current addr from next addr to get current instructions length – blabb Feb 13 at 17:47
  • Minhook and Detours aren't disassembly libraries – Jon Feb 14 at 8:32
  • There is nothing to calculate. There is no rhyme or reason to the length of x86/x64 opcodes. If you want the length of an opcode, you'll going to have to look up that specific opcode. Make sure to get any argument types correct; a simple jump jz can be from 2 to up to -- I think -- 5 bytes long. – usr2564301 Feb 14 at 16:28
0

In Ollydbg it shows the opcodes to the left of the instructions you are currently looking at, inside of the disassembly view.

There isn't anything to calculate, its already there. You can just extract that then get the length through what opcode range you are looking at.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.