Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have two bytes '\x74\x06' and I want a list of all instructions that start with this opcode.
What tools would you use for this? I am trying to do it with Immunity Debugger but so far no luck. The only solution I found is based on Example 3 from corelancoder's cheatsheet. However this requires that there is a binary currently loaded in Immunity and that it contains an instruction starting with that opcode.
How can I quickly get a mapping (partial) opcode -> instruction?
Here is a way to do this with radare2 program rasm2
rasm2 -a x86 -b 32 -d 7406
je 0x8
This has obviously already been established as je from the other answers.
But for arguments sake, say you wanted to decode all instructions starting with 0x74 for one additional byte, you could then run the above in a loop and try and find all valid instructions. This example is for Linux or a Unix shell of some kind, I presume you could achieve the similar with mingw or Powershell:
for x in `seq 0 255`;do printf "74%02x " $x;rasm2 -a x86 -b 32 -d 74`printf "%02x" $x`;done
Produces:
7400 je 0x2
7401 je 0x3
7402 je 0x4
7403 je 0x5
(etc...)
Another example:
for x in `seq 0 255`;do printf "33%02x " $x;rasm2 -a x86 -b 32 -d 33`printf "%02x" $x`;done
gives
3300 xor eax, [eax]
3301 xor eax, [ecx]
3302 xor eax, [edx]
3303 xor eax, [ebx]
3304 disassemble error at offset 0
invalid
3305 disassemble error at offset 0
invalid
3306 xor eax, [esi]
(etc)
You could then write a script to grep out the errors and just show valid codes (or the opposite even if you wanted)
0x74: JZ/JE - ref.x86asm.net/coder32.html#x74
Jun 4, 2014 at 14:01
windbg
0:000> .for ( r $t0 = 0; @$t0 < 0x8 ;r $t0 = @$t0 +1 ) {eb eip 74 @$t0; u @eip l1 ; !opcodemap }
calc!WinMain+0x5:
01001f56 7400 je calc!WinMain+0x7 (01001f58)
Instr OpCode Dest Source
je 7400 01001f58
calc!WinMain+0x5:
01001f56 7401 je calc!WinMain+0x8 (01001f59)
Instr OpCode Dest Source
je 7401 01001f59
calc!WinMain+0x5:
01001f56 7402 je calc!WinMain+0x9 (01001f5a)
Instr OpCode Dest Source
je 7402 01001f5a
calc!WinMain+0x5:
01001f56 7403 je calc!WinMain+0xa (01001f5b)
Instr OpCode Dest Source
je 7403 01001f5b
calc!WinMain+0x5:
01001f56 7404 je calc!WinMain+0xb (01001f5c)
Instr OpCode Dest Source
je 7404 01001f5c
calc!WinMain+0x5:
01001f56 7405 je calc!WinMain+0xc (01001f5d)
Instr OpCode Dest Source
je 7405 01001f5d
calc!WinMain+0x5:
01001f56 7406 je calc!WinMain+0xd (01001f5e)
Instr OpCode Dest Source
je 7406 01001f5e
calc!WinMain+0x5:
01001f56 7407 je calc!WinMain+0xe (01001f5f)
Instr OpCode Dest Source
je 7407 01001f5f
trying another variation notice how disassemble with one constant byte one variable byte automatically pulls other bytes as needed
0:000> .for ( r $t0 = 0; @$t0 < 0x8 ;r $t0 = @$t0 +1 ) {eb eip ff @$t0; u @eip l1 ; !opcodemap }
calc!WinMain+0x5:
01001f56 ff00 inc dword ptr [eax]
Instr OpCode Dest Source
inc ff00 dword ptr [eax]
calc!WinMain+0x5:
01001f56 ff01 inc dword ptr [ecx]
Instr OpCode Dest Source
inc ff01 dword ptr [ecx]
calc!WinMain+0x5:
01001f56 ff02 inc dword ptr [edx]
Instr OpCode Dest Source
inc ff02 dword ptr [edx]
calc!WinMain+0x5:
01001f56 ff03 inc dword ptr [ebx]
Instr OpCode Dest Source
inc ff03 dword ptr [ebx]
calc!WinMain+0x5:
01001f56 ff0406 inc dword ptr [esi+eax]
Instr OpCode Dest Source
inc ff0406 dword ptr [esi+eax]
calc!WinMain+0x5:
01001f56 ff0506010081 inc dword ptr ds:[81000106h]
Instr OpCode Dest Source
inc ff0506010081 dword pt
calc!WinMain+0x5:
01001f56 ff06 inc dword ptr [esi]
Instr OpCode Dest Source
inc ff06 dword ptr [esi]
calc!WinMain+0x5:
01001f56 ff07 inc dword ptr [edi]
Instr OpCode Dest Source
inc ff07 dword ptr [edi]
0x74is alwaysjz/je(they're synonymous). In Linux you can generate all byte sequences you're interested of, pipe them to some disassembler (I like udcli) andgrepthe output for valid instructions, like this (to get all 2-byte x86-64 instructions that begin with0f):bytes='0f'; bytes_wo_spaces=$(echo $bytes | tr -d ' '); for i in {0..255}; do printf "$bytes %x\n" $i | udcli -x -64; done | grep $bytes_wo_spaces | grep -v '\<invalid\>'. This can be extended to longer instructions too (to some limit). It can probably be done in Windows console too.