windbg: How to determine the opcode for an assembly language instruction or set of instructions

Question

I am working on an assignment to perform an exploit using a rop chain. While I understand the basics behind rop, I don't know how to convert instructions like

xchg eax, esp; retn;

to their opcodes.

I tried using:

0:005> a
input> xchg eax,esp

but the address given just points to a totally different kind of instruction in my program. I believe it was an add command.

Answer 1

RTA is an easy to use tool that allows you to enter either opcodes or mnemonics and will convert them from one to the other.

In the example below, I entered XCHG EAX,ESP and RETN on the right, and RTA produced 94 and C3 on the left:

If, on the other hand, you really want to use WinDbg, then you need to do the following:

1. Load a target into WinDbg
2. Type a, Enter to enter Input mode
3. Type your mnemonics (for example, xchg eax,esp), Enter
4. Press Enter again to escape Input mode
5. Type u, Enter to show the disassembly of what you just assembled

​See below for an example:

0:000> a
778e05a6 xchg eax,esp
xchg eax,esp
778e05a7 

0:000> u
ntdll!LdrVerifyImageMatchesChecksum+0x633:
778e05a6 94              xchg    eax,esp

Answer 2

You can use assembler. Or online assembler such as this Or you can use Ida's Edit-->Patch program-->Assemble submenu if you use Ida.