Mastering Reverse Engineering

Opcode bytes

Every instruction has an equivalent opcode (operation code) byte:

Address     Opcode          Instructions00A92D7C    B8 00000080     MOV EAX,80000000h00A92D81    B9 02000000     MOV ECX,200A92D86    F7E1            MUL ECX

In the preceding code, the MOV instruction is equivalent to the B8 opcode byte. The MOV instruction at the 00A92D81 address is equivalent to B9. The difference between the two MOV instructions is the register into which the DWORD value is moved. There are a total of 5 bytes consumed in MOV EAX, 80000000h. It consists of the opcode byte, B8, and the operand value, 80000000h. The same number of bytes is also used in MOV ECX, 2, and MUL ECX uses 2 bytes.

MOV EAX, 80000000h is located at 00A92D7ch. Add 5 bytes (becomes 00A92D81) and we get to the address ...