How might I convert Intel 80386 Machine Code to Assembly Language?

Question

I\'ve been given the following task:

Consider the following sequence of hexadecimal values:

55 89 E5 83 EC 08 83 E4 F0 31 C9 BA 01 00 00 0

Answer 1

You should use a disassembler to see what are the instructions. You can grab NDISASM from the NASM package. Store the bytes in a file and run:

ndisasm -b 32 file        # -b 32 specifies you're running in 32 bit mode

Answer 2

I wouldn't use a disassembler, go through the instruction manual and figure out what each group of bits could mean. This will get you the corresponding assembly instruction. From there it shouldn't be too hard to get that into C. I agree with the other poster that it is messed up doing this assignment in x86. Something like SPARC or MIPS would be much easier (as these have fixed width instructions).

Answer 3

// hex.c
1   #include <sys/mman.h>
2   #include <string.h>
3   
4   int main () {
5     char code[] = {0xB8, 0x3C, 0x0, 0x0, 0x0, 0xBF, 0x2, 0x0, 0x0, 0x0, 0xBA, 0x7D, 0x0, 0x0, 0x0, 0xC3};
6     void *buf;
7     buf = mmap (0,sizeof(code),PROT_READ|PROT_WRITE|PROT_EXEC,MAP_PRIVATE|MAP_ANON,-1,0);
8     memcpy (buf, code, sizeof(code));
9     return 0;
10  }

// gcc -g hex.c -o hex
gdb hex;
b 9;
r;
x /10i buf

mov $0x3c,%eax
mov $0x2,%edi
mov $0x7d,%edx
ret

Answer 4

There's a much simpler method than those suggested, and I suspect this is the one the teacher has in mind:

1. Go to a command prompt
2. run Debug
3. command "e"
4. enter the byte values
5. command "u"
6. read the results

Decoding opcodes from the chart is very, very tedious, and I'd be surprised if that was what was intended.

Answer 5

While you could cheat and use a dissassembler (a disassembler would not be very much help in learning), I would recommend actually learning something by reading the relevant chapters in the Intel 80386 manual. Start with Chapter 17. If/when you get stuck, come back to StackOverflow and post a question stating exactly how far you've gotten and what you don't understand.

Answer 6

Use objdump -d if you're using Unix.