0
  1. How to calculate x86 code mov offset(machine code)? please also give an example !!

  2. I want to input full address. Anyway make it possible? Address: 7FFB4AB12910, I want something like this: 48 8B 0D 352047A4B4FF07

7FFB4A0A0003 - 48 8B 0D 0629A700     mov rcx,[7FFB4AB12910]
7
  • 1
    I do not understand what you mean by “calculate mov offset.” Can you explain what you need in detail? Note that no standard addressing mode supports a 64 bit displacement. Either load the address into a register first, or use the mov rax, moff64 opcode for this purpose (e.g. mov rax, [7FFB4AB12910]). This instruction can only be used with the A register (al/ax/eax/rax).
    – fuz
    Apr 18, 2021 at 11:32
  • @fuz 1.sorry!! it is "calculate the offset of code mov ".
    – Chris
    Apr 18, 2021 at 12:12
  • @fuz 2. 7FFB4AB12910 - 7FFB4A0A0003 = A7290D. It does not match the offset(A72906). any thing wrong?
    – Chris
    Apr 18, 2021 at 12:17
  • 1
    Recall that the offset is computed relative to the beginning of the next instruction. Also note that x86 instructions are encoded in little endian, so 06 29 A7 00 is 0x00A72906. If you account for these two things, you'll see that the instruction is encoded correctly.
    – fuz
    Apr 18, 2021 at 12:18
  • 1
    For x86, this is challenging. You basically have to decode the instruction completely to find out how long it is. Use a library like libcapstone if possible. There are some questions on this subject on this site, but they all boil down to “good luck.”
    – fuz
    Apr 18, 2021 at 12:32

0