2

I have two bytes '\x74\x06' and I want a list of all instructions that start with this opcode.

What tools would you use for this? I am trying to do it with Immunity Debugger but so far no luck. The only solution I found is based on Example 3 from corelancoder's cheatsheet. However this requires that there is a binary currently loaded in Immunity and that it contains an instruction starting with that opcode.

How can I quickly get a mapping (partial) opcode -> instruction?

  • 1
    0x74 is always jz/je (they're synonymous). In Linux you can generate all byte sequences you're interested of, pipe them to some disassembler (I like udcli) and grep the output for valid instructions, like this (to get all 2-byte x86-64 instructions that begin with 0f): bytes='0f'; bytes_wo_spaces=$(echo $bytes | tr -d ' '); for i in {0..255}; do printf "$bytes %x\n" $i | udcli -x -64; done | grep $bytes_wo_spaces | grep -v '\<invalid\>'. This can be extended to longer instructions too (to some limit). It can probably be done in Windows console too. – nrz Jun 4 '14 at 16:02
2

Here is a way to do this with radare2 program rasm2

rasm2 -a x86 -b 32 -d 7406

je 0x8

This has obviously already been established as je from the other answers.

But for arguments sake, say you wanted to decode all instructions starting with 0x74 for one additional byte, you could then run the above in a loop and try and find all valid instructions. This example is for Linux or a Unix shell of some kind, I presume you could achieve the similar with mingw or Powershell:

for x in `seq 0 255`;do printf "74%02x " $x;rasm2 -a x86 -b 32 -d 74`printf "%02x" $x`;done

Produces:

7400 je 0x2
7401 je 0x3
7402 je 0x4
7403 je 0x5

(etc...)

Another example:

for x in `seq 0 255`;do printf "33%02x " $x;rasm2 -a x86 -b 32 -d 33`printf "%02x" $x`;done

gives

3300 xor eax, [eax]
3301 xor eax, [ecx]
3302 xor eax, [edx]
3303 xor eax, [ebx]
3304 disassemble error at offset 0
invalid
3305 disassemble error at offset 0
invalid
3306 xor eax, [esi]

(etc)

You could then write a script to grep out the errors and just show valid codes (or the opposite even if you wanted)

1

If it's x86, and I'm quite sure it is, you should check this link and this link.

  • 1
    Yes, as can be seen in yaspr's first link, only one x86 instruction starts with 0x74: JZ/JE - ref.x86asm.net/coder32.html#x74 – Jason Geffner Jun 4 '14 at 14:01
  • Thank you yaspr. The links are indeed very helpful. However I would appreciate a tool-based solution to avoid the dependencie to websites that might go offline without notice – John Nemo Jun 13 '14 at 8:25
0

windbg
0:000> .for ( r $t0 = 0; @$t0 < 0x8 ;r $t0 = @$t0 +1 ) {eb eip 74 @$t0; u @eip l1 ; !opcodemap }

calc!WinMain+0x5:
01001f56 7400            je      calc!WinMain+0x7 (01001f58)

Instr   OpCode  Dest    Source
je  7400        01001f58
calc!WinMain+0x5:
01001f56 7401            je      calc!WinMain+0x8 (01001f59)

Instr   OpCode  Dest    Source
je  7401        01001f59
calc!WinMain+0x5:
01001f56 7402            je      calc!WinMain+0x9 (01001f5a)

Instr   OpCode  Dest    Source
je  7402        01001f5a
calc!WinMain+0x5:
01001f56 7403            je      calc!WinMain+0xa (01001f5b)

Instr   OpCode  Dest    Source
je  7403        01001f5b
calc!WinMain+0x5:
01001f56 7404            je      calc!WinMain+0xb (01001f5c)

Instr   OpCode  Dest    Source
je  7404        01001f5c
calc!WinMain+0x5:
01001f56 7405            je      calc!WinMain+0xc (01001f5d)

Instr   OpCode  Dest    Source
je  7405        01001f5d
calc!WinMain+0x5:
01001f56 7406            je      calc!WinMain+0xd (01001f5e)

Instr   OpCode  Dest    Source
je  7406        01001f5e
calc!WinMain+0x5:
01001f56 7407            je      calc!WinMain+0xe (01001f5f)

Instr   OpCode  Dest    Source
je  7407        01001f5f

trying another variation notice how disassemble with one constant byte one variable byte automatically pulls other bytes as needed

0:000> .for ( r $t0 = 0; @$t0 < 0x8 ;r $t0 = @$t0 +1 ) {eb eip ff @$t0; u @eip l1 ; !opcodemap }

calc!WinMain+0x5:
01001f56 ff00            inc     dword ptr [eax]

Instr   OpCode  Dest    Source
inc ff00        dword ptr [eax]    
calc!WinMain+0x5:
01001f56 ff01            inc     dword ptr [ecx]

Instr   OpCode  Dest    Source
inc ff01        dword ptr [ecx]    
calc!WinMain+0x5:
01001f56 ff02            inc     dword ptr [edx]

Instr   OpCode  Dest    Source
inc ff02        dword ptr [edx]    
calc!WinMain+0x5:
01001f56 ff03            inc     dword ptr [ebx]

Instr   OpCode  Dest    Source
inc ff03        dword ptr [ebx]    
calc!WinMain+0x5:
01001f56 ff0406          inc     dword ptr [esi+eax]

Instr   OpCode  Dest    Source
inc ff0406      dword ptr [esi+eax]
calc!WinMain+0x5:
01001f56 ff0506010081    inc     dword ptr ds:[81000106h]

Instr   OpCode  Dest    Source
inc ff0506010081        dword pt
calc!WinMain+0x5:
01001f56 ff06            inc     dword ptr [esi]

Instr   OpCode  Dest    Source
inc ff06        dword ptr [esi]    
calc!WinMain+0x5:
01001f56 ff07            inc     dword ptr [edi]

Instr   OpCode  Dest    Source
inc ff07        dword ptr [edi]  

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.