Question

I have built in IDE x86 debbuger which disassemble this:

First case:

65 48 8B 05 30 00 00 00
mov rax,gs:[rel $00000030]

Second case:

65 48 8B 04 25 30 00 00 00
mov rax,gs:[+$0030]

What is the difference?

I suspect that something is wrong with disassembling but can’t translate upper opcodes.

What I know is:

• 65 is gs prefix
• 48 is REX.W prefix
• 8B is mov …
• …???

Answer 1

The first one is RIP relative, while the second one is and absolute address.

For a translation of the opcodes, see http://www.sandpile.org .
As Polynomial noted, http://ref.x86asm.net is even better but does currently not have support for AVX or XOP.

• 8B – opcode – is given as mov Gv, Ev, where Gv indicates a register target, where Ev is a r/m destination.
• 05 – mod r/m – indicate rax as target, with rip relative as effective address
• 30 00 00 00 the offset to rip

The second one:

• 8B – opcode – is given as mov Gv, Ev, where Gv indicates a register target, where Ev is a r/m destination.
• 04 – mod r/m – indicate rax as target, with sib as effective address
• 25 – sib – address is in format [basereg + indexreg*stride + offset], in this case both base and index are 0.
• 30 00 00 00 the offset.