Finding machine language encodings

By Wolfgang Keller
Originally written 2019-06-02
Last modified 2019-06-02

Table of contents

nasm

Using nasm, finding machine language encoding is very easy. Create a file, let's name it nasm_32.asm:

bits 32

mov eax, 12345678h
nop
ret

If you want to create 16 or 64 bit assembly code, change the line bits 32 appropriately.

Assemble it via nasm nasm_32.asm. This creates a file called nasm_32. Now disassemble it using ndisasm -b 32 nasm_32:

00000000  B878563412        mov eax,0x12345678
00000005  90                nop
00000006  C3                ret

If you want to disassemble 16 or 64 bit machine code, change the parameter -b 32 appropriately.

masm and dumpbin

Unter Finding Machine Language Encodings [published 2017-02-15; visited 2019-05-31T11:00:51Z], one can find a tutorial how to use masm and dumpbin to find machine language encodings of x86 assembly language instructions. The following explanation is based on this source, complemented by an own explanation for the 64 bit version.

We first remark that masm and dumpbin do not support 16 bit machine code - only 32 and 64 bit.

32 bit

Start “x86 Native Tools Command Prompt for VS 2019” (also “x64_x86 Cross Tools Command Prompt for VS 2019” might do it).

Create a file, let's name it masm_32.asm:

.model flat
.code
example PROC
    mov eax, 12345678h
    nop
    ret
example ENDP
END

Compile it using ml /c masm_32.asm. This creates a file called masm_32.obj. Now disassemble it using dumpbin /DISASM masm_32.obj:

Microsoft (R) COFF/PE Dumper Version 14.21.27702.2
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file masm_32.obj

File Type: COFF OBJECT

example:
  00000000: B8 78 56 34 12     mov         eax,12345678h
  00000005: 90                 nop
  00000006: C3                 ret

  Summary

           0 .data
          88 .debug$S
           7 .text$mn

64 bit

Either start “x64 Native Tools Command Prompt for VS 2019” (also “x86_x64 Cross Tools Command Prompt for VS 2019” might do it).

Create a file, let's name it masm_64.asm:

.code
example PROC
    mov eax, 12345678h
    nop
    ret
example ENDP
END

Compile it using ml64 /c masm_64.asm. This creates a file called masm_64.obj. Now disassemble it using dumpbin /DISASM masm_64.obj:

Microsoft (R) COFF/PE Dumper Version 14.21.27702.2
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file masm_64.obj

File Type: COFF OBJECT

example:
  0000000000000000: B8 78 56 34 12     mov         eax,12345678h
  0000000000000005: 90                 nop
  0000000000000006: C3                 ret

  Summary

           0 .data
          88 .debug$S
           7 .text$mn