delphi - How do I interpret the columns of the CPU window's disassembly pane? -


there tool called cpu window, pressing ctrl+alt+c, shows disassembly of code.

a green arrow left of memory address indicates location of current execution point, there memory addresses, second column mean, , why compiler jump more 1 address after instruction?

for example:

|first column|second column|assembly| 004520f4 55             push ebp      //continuous  004520f5 8bec           mov ebp, esp  //jumps f7 004520f7 6a00           push $00      //jumps f9 004520f9 53             push ebx      //continuous 004520fa 33d2           xor edx,edx 

let's @ code:

 004520f4 55             push ebp       004520f5 8bec           mov ebp, esp   004520f7 6a00           push $00       004520f9 53             push ebx       004520fa 33d2           xor edx,edx 

each line here represent single machine instruction. information presented follows:

  • the first column address @ instruction starts, displayed in hex.
  • the second column machine code instruction, displayed in hex.
  • the third column instruction disassembled assembler language.

so second , third columns represent exact same information. third column provided make code more understandable.

note different instructions have different lengths. first , fourth instructions single byte long. others 2 bytes long. , explains why instruction address increments more single byte following 2 byte instructions.

there instructions can take more 2 bytes , can have increments of 3, 4 , on such instructions. example call or jump instructions encode target address or offset. so, absolute jump on 32 bit machine might encoded in 5 bytes, 1 opcode , 4 address.

back in old days, long before born, programmers didn't have assemblers , wrote code directly in machine instructions. must have been whole load of fun!


Comments