Why does NASM use 0x89 opcode (137) when it assembles a MOV
instruction between two registers?
Here is an example of code assembled using NASM:
55 push ebp
89E5 mov ebp, esp
83EC04 sub esp, byte +0x4
31C0 xor eax, eax
C9 leave
C3 ret
I wanted something like this:
55 push ebp
8BEC mov ebp, esp
83EC04 sub esp, byte +0x4
33C0 xor eax, eax
C9 leave
C3 ret
The reason I wanted 0x8B was: if you view the binary representation of the MOV
instruction, it looks like this in NASM:
Opcode Mod Reg R/M
10001001 11 100 101 (89 E5)
The confusing part in this is that the reg operand is the second.
The NASM syntax is this: 0x89 11 source_reg destination_reg
and the MOV instruction is mov destination_reg, source_reg