delphiassemblycpu-registersdisassembly

How do I interpret the columns of the CPU window's disassembly pane?


There is a tool called the CPU window, which I get pressing Ctrl+Alt+C, that shows the disassembly of my code.

A green arrow to the left of the memory address indicates the location of the current execution point, then there is the memory addresses, but what does the second column mean, and why does the compiler sometimes jump more than one address after an instruction?

For example:

|first column|second column|assembly|
004520F4 55             push ebp      //continuous 
004520F5 8BEC           mov ebp, esp  //jumps to F7
004520F7 6A00           push $00      //jumps to F9
004520F9 53             push ebx      //continuous
004520FA 33D2           xor edx,edx

Solution

  • Let's look at the code:

    004520F4 55             push ebp      
    004520F5 8BEC           mov ebp, esp  
    004520F7 6A00           push $00      
    004520F9 53             push ebx      
    004520FA 33D2           xor edx,edx
    

    Each line here represent a single machine instruction. The information presented is as follows:

    So the second and third columns represent the exact same information. The third column is provided to make the code more understandable.

    Note that different instructions have different lengths. The first and fourth instructions are only a single byte long. The others are two bytes long. And that explains why the instruction address increments by more than a single byte following two byte instructions.

    There are instructions that can take even more than two bytes and so you can have increments of 3, 4 and so on for such instructions. A good example would be call or jump instructions which encode the target address or offset. So, an absolute jump on a 32 bit machine might be encoded in 5 bytes, one for the opcode and four for the address.

    Back in the good old days, long before I was even born, programmers didn't even have assemblers and wrote code directly in machine instructions. That must have been a whole load of fun!