2

Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of instruction using say ollydbg or immunity debugger??

I am very new to this and I do not want to use a disassembly library like Minhook and Microsoft Detours. Just something done manually.

Improve this question
3
  • 1
    can you rephrase Your question ollydbg shows the opcodes for each instruction also it shows the address of current instruction and address of next instruction either count the opcode bytes or subtract current addr from next addr to get current instructions length Commented Feb 13, 2020 at 17:47
  • 1
    Minhook and Detours aren't disassembly libraries Commented Feb 14, 2020 at 8:32
  • There is nothing to calculate. There is no rhyme or reason to the length of x86/x64 opcodes. If you want the length of an opcode, you'll going to have to look up that specific opcode. Make sure to get any argument types correct; a simple jump jz can be from 2 to up to -- I think -- 5 bytes long. Commented Feb 14, 2020 at 16:28

1 Answer 1

Reset to default
1

In Ollydbg it shows the opcodes to the left of the instructions you are currently looking at, inside of the disassembly view.

There isn't anything to calculate, its already there. You can just extract that then get the length through what opcode range you are looking at.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.