3

So basically I use a IDC script to dump the instructions one by one using IDA Pro 6.1, windows 32 bit. PE file format

I use try to dump one opcode instructions like

stosd
stosb
stosq
movsd

in this way:

for (addr = funcStart; addr != BADADDR; addr = NextHead(addr, funcEnd)) {
 ......
auto code;
line = GetDisasm(addr);
mnem = GetMnem(addr);
.......
if (strstr(line, mnem) != 0) {
        mnem = line;
}
line = form("%-8s", mnem);

But to my surprise, when meets one opcode instructions like those, mnem get things like

stos
stos
stos
movs
movs
movs

By checking the directly dumped asm file ** File->Produce File->Create ASM File...**, I find those error instructions should be

stosd
stosd
stosd
movsd
movsd
movsd

Which means the results API GetMnem generated is wrong...

Could anyone give me some help? THank you!

7

If you take a look at the specific opcodes for those instructions, they are the same. To be more precise, "stos m8" and stob have the same opcode (0xAA) as do "STOS m16" , "STOS m32", "STOSW" and "STOSD" (0xAB). To quote the manual:

At the assembly-code level, two forms of this instruction are allowed: the "explicit-operands" form and the "no-operands" form. The explicit-operands form (specified with the STOS mnemonic) allows the destination operand to be specified explicitly. Here, the destination operand should be a symbol that indicates the size and location of the destination value. The source operand is then automatically selected to match the size of the destination operand (the AL register for byte operands, AX for word operands, and EAX for doubleword operands). This explicit-operands form is provided to allow documentation; however, note that the documentation provided by this form can be misleading. That is, the destination operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword), but it does not have to specify the correct location. The location is always specified by the ES:(E)DI registers, which must be loaded correctly before the store string instruction is executed.

And from the GetMnem documentation:

note: this function may not return exactly the same mnemonics as you see on the screen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.