r/m8 operand being interpreted as r/m32 operand by disassembler

Viewed 76

Pretty much I've been working on my (basic) disassembler, everything works fine but after disassembling some bytes I noticed something weird:

This is the set of instructions I'm trying to decode:

unsigned char Data[] = {
        0xF0, 0xF0, 0x55, 0xFF, 0x89, 0xE5, 0xB8, 0x04, 0x00, 0x00, 0x00, 0x40, 0x48, 0xC3, 0xF4,
        0xCC, 0xCC, 0xCC, 0x66, 0xE7, 0xFF, 0xF0
    };

and this is the Disassembler's output:

enter image description here

The 00 00 (ADD [AL], AL) is weird to me: moving the value of al into the address at al doesn't seem right. I am wondering if my output is correct...

I also tested it against defuse.ca's online disassembler, and this is what I got from there:

Disassembly:
0:  f0 f0 55                lock lock push ebp
3:  ff 89 e5 b8 04 00       dec    DWORD PTR [ecx+0x4b8e5]
9:  00 00                   add    BYTE PTR [eax],al
b:  40                      inc    eax
c:  48                      dec    eax
d:  c3                      ret
e:  f4                      hlt
f:  cc                      int3
10: cc                      int3
11: cc                      int3
12: 66 e7 ff                out    0xff,ax
15: f0                      lock

0 Answers
Related