I'm checking the assembly code for a MOV
instruction on Intel 64 (long) compatibility sub-mode.
For a mov edx,408ACB77
the debugger (x32dbg for Windows) shows
BA 408ACB77
From Intel 64 SDM this MOV instruction in compatibility mode should use a one-byte opcode plus a 32bit immediate value (77CB8A40
). In Intel SDM the opcode for MOV
should be B8 +rd id
. +rd
means look at the lower three bit of one-byte opcode for the target dword register (i.e. 32 bit register).
From Table 3.1 the EDX
register has index 0x2
then we get 0x8+0x2 = 0xA
, hence the opcode byte is actually BA
.
Is the above correct ? Thanks in advance.