Some instructions with corresponding opcodes:
xor eax, eax x31xc0
xor ecx, ecx x31xc9
xor edx, edx x31xd2
xor ebx, ebx x31xdb
Could someone please explain the calculation behind the second byte (it increases in steps of 9 down the list) and the reason for the xc0 ‘base’?
1
The two most significant bits (6 and 7) of this byte correspond to the MOD field. When they both are 1, the register addressing mode is enabled, and other 6 bits determine two registers (3 bits per one register):
- 000 – EAX
- 001 – ECX
- 010 – EDX
- 011 – EBX
- 100 – ESP
- 101 – EBP
- 110 – ESI
- 111 – EDI