Log in

View Full Version : I don't know anything about assembly instructions

nicromonicon
February 28th, 2005, 07:12
in hiew we dont want nop,jne,je..... right?
we want it all jmp..
so we converse from 85 to 84 and so..
my question is: where to get all conversions? like 90,74,0F8C and so?
thnx
naides
February 28th, 2005, 07:19
In Hiew you should use decode mode, then while the cursor is at the opcode you want to change click F3 (edit) then F2 (asm) Now you can write the instruction you want:

Jmp 0x???????? and HIEW will lookup the correct hex equivalent and replace it for you

Option 2: Search in Reverse tools repositories, there are some utilities that lookup the hex equivalent of an opcode for you.
nicromonicon
February 28th, 2005, 07:47
??
nicromonicon
February 28th, 2005, 07:54
i didnt understand see i want reverse of this..
example
85----->turned to 84
0F8C------>???
0F83----->???
0F82----->???
0F86----->???
0F8E----->???


and so on...
ZaiRoN
February 28th, 2005, 08:22
Quote:
The meaning of the different jumps: jne, je, jmp, ja, js, jg, jl, jle, jge ??
The answer is in your signature: I promise that I have read the FAQ ("http://www.woodmann.com/fravia/rce-faq.htm") and tried to use the Search ("http://www.woodmann.com/forum/search.php?") to answer my question.
blabberer
February 28th, 2005, 08:40
well try to grab opcodes.hlp
its avl in the masm package by hutch
or look in biws site you can get it seperate
or better google
it has all those opcodes and thier menaings defined properly
like this
Quote:

0F 8C cw/cd JNGE rel16/32 Jump near if not greater or equal (SF<>OF)
0F 8D cw/cd JNL rel16/32 Jump near if not less (SF=OF)

0F 8F cw/cd JNLE rel16/32 Jump near if not less or equal (ZF=0 and SF=OF)


or get ollydbg and use its assemble feature and assemble all jcc one by one and get the relevernt opcodes like this

Code:


004012EC    ^\EB F6            JMP     SHORT <virtualq.bullshit>

004012EE    ^ E9 F1FFFFFF      JMP     <virtualq.bullshit>

004012F3    ^ 74 EF            JE      SHORT <virtualq.bullshit>

004012F5    ^ 0F84 E9FFFFFF    JE      <virtualq.bullshit>

004012FB    ^ 75 E7            JNZ     SHORT <virtualq.bullshit>

004012FD    ^ 0F85 E1FFFFFF    JNZ     <virtualq.bullshit>

00401303    ^ 78 DF            JS      SHORT <virtualq.bullshit>

00401305    ^ 79 DD            JNS     SHORT <virtualq.bullshit>

00401307    ^ 0F88 D7FFFFFF    JS      <virtualq.bullshit>

0040130D    ^ 0F89 D1FFFFFF    JNS     <virtualq.bullshit>

00401313      7A CF            JPE     SHORT <virtualq.bullshit>

00401315      7B CD            JPO     SHORT <virtualq.bullshit>

00401317      0F8A C7FFFFFF    JPE     <virtualq.bullshit>

0040131D      0F8B C1FFFFFF    JPO     <virtualq.bullshit>

00401323    ^ 72 BF            JB      SHORT <virtualq.bullshit>

00401325    ^ 73 BD            JNB     SHORT <virtualq.bullshit>

00401327    ^ 0F82 B7FFFFFF    JB      <virtualq.bullshit>

0040132D    ^ 0F83 B1FFFFFF    JNB     <virtualq.bullshit>

00401333    ^ 7C AF            JL      SHORT <virtualq.bullshit>

00401335    ^ 0F8C A9FFFFFF    JL      <virtualq.bullshit>

0040133B    ^ 0F8C A3FFFFFF    JL      <virtualq.bullshit>

00401341    ^ 0F8D 9DFFFFFF    JGE     <virtualq.bullshit>


i dont use hiew much (its great for search and replace and that is the only function i do with it

as far as i know it will put 66 prefix if you use f4--> f4---> f3 ---> f2
f4 -> f4 == mode hex
f3 == edit
f2 == asm
f9 == update
but i may be wrong coz i have some old probably hiew16
blabberer
February 28th, 2005, 08:44
oops double meaning less post i think you should get a dose of jmi's tonic
it will be good for your health
nicromonicon
February 28th, 2005, 09:05
downloaded the help file...didnt help
plz guys all i want is the reverse of 0F8C thats all ..
thnx
CrackZ
February 28th, 2005, 09:27
Your best reference is the Intel manuals, specifically the Instruction Set References.

hxxp://www.intel.com/design/pentiumii/manuals/243191.htm

Regards

CrackZ.

NB - If this isn't exactly what you want you get my drift, just search around intel.com.
Hero
February 28th, 2005, 09:49
I will describe more for you:
Open an assembly ebook(for example Art of assembly),then jumps section,You will see
a table that discuss all of them.

sincerely yours
nicromonicon
February 28th, 2005, 10:07
thnx man!
nicromonicon
February 28th, 2005, 13:20
whats the reverse of 0FC8 ?
where to find reverse of opcodes?
thnx
lifewire
February 28th, 2005, 13:37
0fc8 is a bswap eax. i used hiew to figure this out, probably the fastest way.
lifewire
February 28th, 2005, 13:40
http://www.unixwiz.net/techtips/x86-jumps.html
http://64.81.49.134/
TBone
February 28th, 2005, 16:37
Whoah. Did some threads just get merged, or am I trapped in some kind of reality-distorting time loop a la Star Trek?
JMI
February 28th, 2005, 17:27
Some threads got merged, one got removed altogether, and someone was sent to their room without supper for creating a mess; for failure to actually read the FAQ; for failing to do any research before asking a series of really basis questions; and, finally, for posting the name of the target and target specific code.

He would also have been spanked, but he was too far away.

Regards,
Woodmann
February 28th, 2005, 21:08
The question has been answered about six times.

This thread comes to an end.

Wood