Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of instruction using say ollydbg or immunity debugger??

I am very new to this and I do not want to use a disassembly library like Minhook and Microsoft Detours. Just something done manually.

  • 1
    can you rephrase Your question ollydbg shows the opcodes for each instruction also it shows the address of current instruction and address of next instruction either count the opcode bytes or subtract current addr from next addr to get current instructions length
    – blabb
    Feb 13 '20 at 17:47
  • 1
    Minhook and Detours aren't disassembly libraries
    – Jon
    Feb 14 '20 at 8:32
  • There is nothing to calculate. There is no rhyme or reason to the length of x86/x64 opcodes. If you want the length of an opcode, you'll going to have to look up that specific opcode. Make sure to get any argument types correct; a simple jump jz can be from 2 to up to -- I think -- 5 bytes long.
    – Jongware
    Feb 14 '20 at 16:28

In Ollydbg it shows the opcodes to the left of the instructions you are currently looking at, inside of the disassembly view.

There isn't anything to calculate, its already there. You can just extract that then get the length through what opcode range you are looking at.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.