How might I convert Intel 80386 Machine Code to Assembly Language?

Question

I've been given the following task:

Consider the following sequence of hexadecimal values:

55 89 E5 83 EC 08 83 E4 F0 31 C9 BA 01 00 00 00 B8 0D 00 00 00 01 D1 01 CA 48 79 F9 31 C0 C9 C3

This sequence of bytes represents a subroutine in Intel 80386 machine language in 32-bit mode.

• When the instructions in this subroutine are executed, they leave values in the registers %ecx and %edx. What are the values?

• What is the program in C that carries out the computation done by this subroutine, then prints the values computed by this program of %ecx and %edx as they would appear at the end of the execution of the subroutine.

As I do not have the 80386 instruction set memorized, I must first convert these opcode bytes into their assembly-language mnemonic equivalents. So, is there an online reference somewhere, a table mapping hex values to instructions or the like? I checked out Intel's website, but could find nothing. Or is there a better way to go about deciphering this...?

Solution 1

You should use a disassembler to see what are the instructions. You can grab NDISASM from the NASM package. Store the bytes in a file and run:

ndisasm -b 32 file        # -b 32 specifies you're running in 32 bit mode

Solution 2

I wouldn't use a disassembler, go through the instruction manual and figure out what each group of bits could mean. This will get you the corresponding assembly instruction. From there it shouldn't be too hard to get that into C. I agree with the other poster that it is messed up doing this assignment in x86. Something like SPARC or MIPS would be much easier (as these have fixed width instructions).

Comments

[Admin]

Correction, the OP should do his homework and figure out the assembly instructions!

[Admin]

Mehrdad, I don't have the assembly file, just the Opcodes in Hex.

[mmx]

@Ray: Use a hex editor to enter hex values in a file. Google hex editor for one that suits your platform.

[Evan Carroll]

@roygbiv: grow up if you don't like the op asking homework questions then add it to your list of ignored tags. Personally, I welcome people trying to understand something even if the question originated in HW.

[Admin]

@Evan Carroll - I think your comment is offensive and out-of-line. You mis-understand and mis-construe what has been said in this thread as the post with the disassembled bytes was removed (Thank you!). Telling me things like "grow up" is childish. I'm not against homework questions. Quite the contrary. I'm trying my best to help the OP learn without being voted off StackOverflow. In fact, I invite him to post back telling us where he is stuck at next so that we can help him. In an effort to encourage learning, blatant answers/help to homework questions should never be given.

[Polaris878]

@Evan, how does the OP using a disassembler for his/her assignment help them understand anything? The disassembler should be used for checking answers, that's it.

[Arthur Kalliokoski]

How do you guys know it's homework? He might be trying to determine the results of a sequence of bytes from a... dare I say it? Stack overflow!

[Frunsi]

@everyone here: as you can see, using the disassembler teaches two brand-new practical things to the op: hex editors and disassemblers on its own. so, its not all too bad to use a disassembler for this task ;-)

[Frunsi]

@akallio: check above comments, he doesn't know hex editors.. so no

[Arthur Kalliokoski]

Running the sequence of bytes through an online disassembler in 16, 32 and 64 bit modes didn't seem to make sense, since the stack pointer was and'ed with a constant, but wasn't restored before the 'leave ret' sequence.

[President James K. Polk]

you are assuming a windows world.

[egrunin]

True. Is there an equivalent 'interactive assembler' tool in *nix?

[prl]

@Arthur, the stack pointer doesn't need to be restored before leave, because the first thing leave does is to move [er]bp into [er]sp.

[jww]

@James - Or, the other answers are assuming Linux when in reality it is a Solaris machine :)

[Peter Cordes]

@jww: ndisasm is portable and will work on Windows and Linux. I upvoted Mehrdad's answer.