assemblyx86-64disassemblyattmachine-code

Understanding disassembler: See how many bytes are used for add


I disassembled a program (with objdump -d a.out) and now I would like understand what the different sections in a line like

400586:       48 83 c4 08             add    $0x8,%rsp

stand for. More specifically I would like to know how you can see how many bytes are used for adding two registers. My idea was that the 0x8 in add $0x8,%rsp, which is 8 in decimal gives me 2 * 4 so 2 bytes for adding 2 registers. Is that correct?

PS: compiler is gcc, OS is suse linux


Solution

  • In the second column you see 48 83 c4 08. Every two-digit hex-number stands for one byte, so the amount of bytes is four. The last 08 correlates to $0x8, the other three bytes are the machine code for "add an 8-bit constant to RSP" (for pedantic editors: Intel writes its registers upper case). It's quite difficult to deconstruct the machine code, but your assumption is completely wrong.