Figure 4.1 Translating an IA-32 instruction from machine code into human-readable
assembly language.
IDA Pro
IDA (Interactive Disassembler) by DataRescue (www.datarescue.com) is an
extremely powerful disassembler that supports a variety of processor architec-
tures, including IA-32, IA-64 (Itanium), AMD64, and many others. IDA also
supports a variety of executable file formats, such as PE (Portable Executable,
used in Windows), ELF (Executable and Linking Format, used in Linux), and
even XBE, which is used on Microsoft’s Xbox. IDA is not cheap at $399 for the
8B 79 04
Instruction
Opcode
MOV Opcode
Defined as:
MOV Register,
Register/Memory
MOD/RM Byte:
Specifies a register and memory-address pair. Displacement Byte
MOV EDI, DWORD PTR ECX + 4
MOD/RM
Byte Displacement
MOD (2 bits) REG (3 bits) R/M (3 bits)
Describes the
format of the
address side
Specifies a
register for the
address side
Specifies a
register
112 Chapter 4