While learning about x64, I struggled to understand some notations in the intel manual.
Let’s look at 0xC7
MOV
:
| opcode | instruction| Op/Enc| Description|
|:——- |:———-:|:—–:|:—-| —|
|C7 /0 iw | MOV r/m16, imm16 | MI | Move imm16 to r/m16.|
C7 /0 id | MOV r/m32, imm32 | MI | Move imm32 to r/m32. |
REX.W + C7 /0 id |MOV r/m64, imm32 | MI | Move imm32 sign extended to 64-bits to r/m64. |
About the /0
../7
it says:
Historically this document only specified the ModR/M.reg field
restrictions with the notation /0 … /7 and did not specify
restrictions on the ModR/M.mod and ModR/M.r/m fields in the encoding
boxes.
My questions are:
- That number after
/0
is a restriction code, but which restriction? What does it mean while interpreting an instruction? - If I’m reading bytes like
c7c701020304...
How to know if I need to ready imm16(0102
or imm32(01020304
)? By testing, I know that in thisimm32
, but I don’t understand why. I deduce that it is related to rex+modrm.
{ xxd --ps -r | ndisasm -b64 -; } <<<c7c701020304
00000000 C7C701020304 mov edi,0x4030201
- In other words: Why
ndisasm
parses that asimm32
insteadimm16
?