6

For the sake of example, imagine I was building a virtual machine. I have a byte array and a while loop, how do I know how many bytes to read from the byte array for the next instruction to interpret an Intel-8086-like instruction?

EDIT: (commented)

The CPU reads the opcode at the instruction pointer, with 8086 and CISC you have one byte and two byte instructions. How do i know if the next instruction is F or FF?

EDIT:

Found an answer myself in this piece of text on http://www.swansontec.com/sintel.html

The operation code, or opcode, comes after any optional prefixes. The opcode tells the processor which instruction to execute. In addition, opcodes contain bit fields describing the size and type of operands to expect. The NOT instruction, for example, has the opcode 1111011w. In this opcode, the w bit determines whether the operand is a byte or a word. The OR instruction has the opcode 000010dw. In this opcode, the d bit determines which operands are the source and destination, and the w bit determines the size again. Some instructions have several different opcodes. For example, when OR is used with the accumulator register (AX or EAX) and a constant, it has the special space-saving opcode 0000110w, which eliminates the need for a separate ModR/M byte. From a size-coding perspective, memorizing exact opcode bits is not necessary. Having a general idea of what type of opcodes are available for a particular instruction is more important.

9
  • what do you mean by "to interrupt an instruction"? Do you know what the word "interrupt" means? As to the original question: the CPU knows how long an instruction is because that information is either burnt into its hardware or programmed to its microcode. Commented Aug 3, 2014 at 5:42
  • the cpu reads the opcode at the instruction pointer, with 8086 and CISC you have one byte and two byte instructions. How do i know if the next instruction is F or FF? EDIT: sorry, meant interpret Commented Aug 3, 2014 at 5:49
  • it knows because every instruction has a fixed length. If the instruction is a long jump, it knows that it has to read the next 4 bytes in addition. If it's an add, it knows it has to read the next 1 byte only. etc., etc. Commented Aug 3, 2014 at 6:01
  • every instruction is not a fixed length? How do i know if the next instruction is F or FF? EDIT: Edited question, found ansew Commented Aug 3, 2014 at 6:38
  • 1
    Sorry, I can't explain it better than that. I didn't write that every instruction has the same length. I wrote that they have a fixed length. E. g. a long jump is always 5 bytes long, an add is maybe 2 bytes long, etc. One can know from the opcode how many additional bytes one should read. Commented Aug 3, 2014 at 6:43

2 Answers 2

8

the cpu simply decodes the instruction. IN the case of 8086 the first byte tells the processor how much more to get. It doesnt have to be the first byte the first byte does have to indicate in some way that you need to get more, that more can indicate you need even more. With 8 bit instruction sets like the x86 family where you start with one byte and then see how much more you need, and also being unaligned, you have to treat the instruction stream as a bytestream in order to decode it.

You should write yourself a very simple instruction set simulator, only a handful of instruction, maybe enough to load a register, add something to it and then loop. extremely educational for what you are trying to understand, and takes maybe a half an hour if that to write.

Sign up to request clarification or add additional context in comments.

9 Comments

this is not a ansew but i already solved it myself, i edited the question before you posted so people please actually read before posting.
Since this has been asked and answered so many times now perhaps you should just delete this question or ask a moderator to delete it.
The other comments is getting the size of a assemblerly instruction where you know the full instruction. E.g mov ax, al
My question is getting the size of the next instruction in memory without knowing what the full instruction is. The 1 byte in is the first instruction byte is only 7-bits and the last bit tells the CPU if it is a word or byte. Im guessing the same thing is used for the next byte for longer instructions if supported in respected instruction set. This is intel so AMD might be different. umcs.maine.edu/~cmeadow/courses/cos335/8086-instformat.pdf
sometimes it has to look at the second byte to determine if there are more and how many. Nothing special here this is how processors work in particular variable length cisc types...can replace 8086 in a statement like that with 6502 or z80 or a long list of others, and the how to decode or how the processor decodes is in the various vendor documentation.
|
7

TLDR:

The solution is more complex than a fixed size array.


It's all about context, this is why disassembler like IDA have complex algorithms to do this.

Instructions are variable length for x86. But if you know the start of an instruction, you know where THAT INSTRUCTION ends. Because of that, you MAY know where the next one begins. I will explain the exceptions soon. But first, here's an example:

ASM:
mov eax, 0
xor eax, eax

Machine:
b8 00 00 00 00
31 c0

Explanation:

Moving to eax is B8, followed by a 32-bit (4-byte) value to move into eax (as eax is 32 bit). In other words, mov eax, immediate will always be 5 bytes. So if you know you are starting on an instruction (not always a safe assumption), and the byte is B8, you know it is a 5 byte instruction, and that the next instruction SHOULD start 5 bytes later.

Note that both instructions (mov eax, 0 and xor eax, eax) effectively do the same thing, clear eax to 0.

Exception:

Things can get tricky with jumps/calls. It is possible to jump into an address space that is in the "middle of an instruction"... but still execute.

Lets look at:

mov eax, 0x90909090

machine code:

b8 90 90 90 90

If we later had a jmp instruction that jumped into the address of the 3rd byte of the above instruction (in the middle of it somewhere), it would just do 3 NOPs (no operation) and fall to the next instruction after it (not setting eax to 0x90909090). This is because a NOP is a 1-byte instruction made up of 0x90.

3 Comments

I already solved it myself, and your wrong. Your over thinking and missing out they key reason the cpu knows how many bytes to read. For one byte instructions, there is a certain bit to tell the CPU to read the next byte as part of the instruction.
I may have been over thinking in the context of your application, but some of the pitfalls I described are not 'wrong.' Jumping to an address in the middle of an instruction is a tactic that malware authors and obfuscators will use. This absolutely will through a linear analysis engine off. Here is a discussion on algorithms to do this: resources.infosecinstitute.com/…. That aside, I read your reference (swansontec.com/sintel.html), it's quite good, and as you said, answered/solved your VM application issues.
Quote "TLDR: The solution is more complex than a fixed size array. It's all about context, this is why disassembler like IDA have complex algorithms to do this. Instructions are variable length for x86. But if you know the start of an instruction, you know where THAT INSTRUCTION ends. Because of that, you MAY know where the next one begins" I am a newb, i have excuses. You however do not - To figure out the size is very important and not hard, you have lived in the software too long. You may know the software, but have no clue of how the hardware understands it what is as or more important.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.