Reversing : The Hacker's Guide to Reverse Engineering

Figure 4.1 Translating an IA-32 instruction from machine code into human-readable

assembly language.

IDA Pro

IDA (Interactive Disassembler) by DataRescue (www.datarescue.com) is an

extremely powerful disassembler that supports a variety of processor architec-

tures, including IA-32, IA-64 (Itanium), AMD64, and many others. IDA also

supports a variety of executable file formats, such as PE (Portable Executable,

used in Windows), ELF (Executable and Linking Format, used in Linux), and

even XBE, which is used on Microsoft’s Xbox. IDA is not cheap at $399 for the

8B 79 04

Instruction

Opcode

MOV Opcode

Defined as:

MOV Register,

Register/Memory

MOD/RM Byte:

Specifies a register and memory-address pair. Displacement Byte

MOV EDI, DWORD PTR ECX + 4

MOD/RM

Byte Displacement

MOD (2 bits) REG (3 bits) R/M (3 bits)

Describes the

format of the

address side

Specifies a

register for the

address side

Specifies a

register

112 Chapter 4