获取操作码的简单方法
我知道如何从可执行文件中获取操作码和相应的汇编语法；然而，有没有一种简单的方法可以单独获取特定汇编指令的操作码，而无需使用相同的程序编写程序，然后手动链接和加载它并对可执行文件执行 objdump？
有没有一种简单的方法可以找到特定指令对应的操作码？
I know how to get the opcodes and the corresponding assembly syntax from an executable; however is there an easy way to get the opcodes of a particular assembly instruction alone, without writing a program using the same and then, manually linking and loading it and doing an objdump on the executable?
Is there a simple way to find the corresponding opcodes of a particular instruction?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您可以使用 gdb（GNU 调试器）的 x/bx 命令。
我在这里做了一个教程：
<删除>
http://aimbots.net/tutorials/9276-how-get-操作码.html
http://aimbots.net/threads/9276-How-to-get-OP-codeshttps://web.archive.org/web/20180814185730/http://aimbots.net /threads/9276-How-to-get-OP-codes
TL;DR;404
假设您需要特定汇编指令的 OP 代码（例如 x64 指令，以覆盖 C 代码。）
一查找操作码的方法是阅读英特尔开发人员手册。
不幸的是，这需要很长时间，而且几乎永远不会导致正确的发现。
所以这是快速的方法，gdb 方法。
假设我们想要 jmp rel32 和 call 的 OP 代码
。实现这一点的方法是编写一个小型汇编程序。
保存为lookup.gas
编译：
现在，在gdb中打开它：
gdb 查找
--> JMP REL32 = 0xE9y
--> CALL = 0xE8
由于 gdb & GAS 在 Windoze 上也可用，您也可以在那里进行...
PS：如果您不喜欢 AT&T 汇编器语法：
等等
或者您可以
使用整个指令的十六进制机器代码（带字节）进行反汇编空间分离。
You can use gdb's (GNU Debugger's) x/bx command.
I made a tutorial here:
http://aimbots.net/tutorials/9276-how-get-op-codes.html
http://aimbots.net/threads/9276-How-to-get-OP-codeshttps://web.archive.org/web/20180814185730/http://aimbots.net/threads/9276-How-to-get-OP-codes
TL;DR;404
Assuming you need an OP-code for a specific assembler instruction (for example an x64 instruction, to overwrite C-Code.)
One way to find the OP-code is to read the Intel Developer's manual.
Unfortunately, this takes very long, and almost never leads to the right finding.
So here is the fast way, the gdb way.
Let's assume we want the OP code for jmp rel32, and for call
The way to do this is to write a tiny assembler program.
save as lookup.gas
Compile:
Now, open it in gdb:
gdb lookup
--> JMP REL32 = 0xE9y
--> CALL = 0xE8
Since gdb & GAS are available on Windoze, too, you can also do it there...
PS: If you don't like AT&T assembler syntax:
And so
Or you can
to get disassembly with hex machine code for the whole instruction, with bytes space-separated.
对于 x86，您可以在 Intel 手册 (第 1 部分 (AM) 中查找它们、第 2 部分（新西兰））。不，我不知道为什么手册分为两部分。
For x86, you can just look them up in the Intel Manual (Part 1 (A-M), Part 2 (N-Z)). And no, I don't know why the manual is split in 2 parts.
我不久前问过类似的问题（DOS 调试类似程序32 位 x86 程序集）。
有人好心地为我提供了一个自动脚本来执行此操作。您可以点击问题链接，或参考他们在下面提供给我的脚本...
希望这会有所帮助。
I asked a similar question a while back (DOS debug like program for 32-bit x86 assembly).
Someone was kind enough to provide me with an automated script to do this. You can follow the link to question, or refer to the script they provided to me below ...
Hope this helps.
X86 操作码和指令参考 包含一堆 32 位和 64 上的指令参考表及其相应的操作码位 x86 处理器。
X86 Opcode and Instruction Reference contains a bunch of reference tables of instructions and their corresponding opcodes on both 32-bit and 64-bit x86 processors.
我不确定你为什么想要操作码。但如果它用于漏洞利用开发，您可能已经拥有metasploit，它附带了一个非常有用的ruby 脚本，名为nasm_shell.rb（在工具目录中）。
您键入的每一行都会以正确操作码的 ascii 十六进制表示形式出现。
如果出于其他目的，或者您不希望像metasploit这样的重量级工具包因某种原因而存在，您可以直接拉出脚本并安装其依赖项。它使用 Rex 并假设已安装 nasm。
如果你想修改它，你需要的实际代码只是函数 shell.run 中的几行
I'm not sure why you want opcodes. But if its for exploit development you probably already have metasploit which comes with a really useful ruby script called nasm_shell.rb (in the tools directory).
Each line you type comes out as an ascii hex representation of the correct opcodes.
If its for some other purpose or you don't want some heavyweight toolkit like metasploit hanging around for whatever reason, you can just pull out the script and install its dependencies. It uses Rex and assumes nasm is installed.
If you want to adapt it the actual code you need is just a few lines in the function shell.run