Re: [LIP] Intel Opcode Query

On Thu, Jun 10, 2004 at 09:12:31AM -0700, Arun Sharma typed:
> On Thu, Jun 10, 2004 at 03:43:09AM -0700, Trideepraj Roychoudhury wrote:
> 
> > 
> > Otherwise how do I decide which addressing mode to use
> > i.e. 16-bit or 32-bit?
> 
> You need to look at both the opcode and prefix.
> 

One more point to add to this :

Without knowing the exact mode (i.e 32 bit vs 16 bit) for which the 
program was targetted, there is no real way to decipher whether the 
size prefix indicates a 32 bit register or a 16 bit one because 
the prefix is more of a Operand size "modifier" rather than a 
"specifier" and is an indicator of "Not the default size".

In protected mode, a flag in the Segment descriptor for the Code Segment 
decides what the default operating mode is. If it is set to 32 bit mode
(which is the default and most common), the additional prefix implies
that the operands are 16 bit, and no prefix indicates 32 bit size. But
if the program is running with the D flag set to 0 (which can be done), 
exactly the opposite would be applicable.

If you're looking at a program targetted for Real mode or Virtual 8086
mode (say a DOS program), the default is always 16 bit, and the prefix 
opcode would indicate a 32 bit operand size.

BK



-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the
one installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504