mioline wrote:So, I used the google and I found a lot of x86 code tables and I saw the official manual too, but I don't understand how the machine code instructions are built (for example: I can't understand what the SIB/Mod/RM byte is).
I added a bit to the end of my previous post pointing towards a particular site which probably gives you the easiest way in:
http://courses.engr.illinois.edu/ece390 ... codes.html. Even so, it takes a lot of re-reading to understand it all. If you're using the 32-bit addressing mode, most oorrrmmm bytes use the mmm part to select the register which is pointing to the memory to be used, but when the oorrrmmm byte has its mmm part set to 100 and the oo part is less than 11, an extra instruction byte has to follow to specify which register is used to point at memory, and there is room left over in that byte for another register to be used as a scaled index, as well as a scale factor. The largest two bits are the scale factor (00=x1, 01=x2, 10=x4, 11=x8), the next three bits are the register containing the index to be multiplied by 1/2/4/8, and the smallest three bits indicate the register which would have been selected by the mmm part of oorrrmmm if it hadn't been set to 100 instead.
Eg: mov EAX,[EBX+2*ECX] becomes the three bytes 139, 4, 75 (decimal values - sorry, but that's the way I write machine code). The 75 in binary is 01,001,011, so the scale factor is 2 (the 01 part), the index to be scaled by that is ECX (the 001), and the result has to be added to the value in EBX (the 011) to get the required memory address.
[Edit: crucial typing error corrected - I'd typed EBX instead of ECX at the top.]
And, my guess is that SIB stands for Scaled Index Byte.