Longest x86 Instruction

Question

I read the recent article "Longest x86 Instruction"

https://web.archive.org/web/20160405202815/http://blog.onlinedisassembler.com/blog/?p=23

I attempted to reproduce the curious disassembly issue on a Win7x86 development platform using masm and as the article suggested, redunant prefixes.

Talk is cheap, so here's a toy program (masm32):

.386 .model flat, stdcall

option casemap:none

includelib \x\x\kernel32.lib
includelib \x\x\user32.lib

include \x\x\kernel32.inc
include \x\x\user32.inc
include \x\x\windows.inc

.code

start:

db 0F3h
db 0F3h
db 0F3h
db 0F3h
db 0F3h
db 0F3h
db 0F3h
;...6 more bytes later
db 089h
db 0E5h

end start

invoke ExitProcess, NULL

After linking and assembling, I opened the resulting executable in windbg.

To my disappointment, when I single step, unassemble the $exentry, etc. windbg simply sees the prefixes/bytes as individual instructions, says 'to hell with it' and executes only the valid instructions.

Is there something I'm missing?

Answer 1

I was confused by the disassembler implementation...the processor executes instructions that are ( i.cache <=15B ) as the artcle states.

Verified when I single step, as IP increases by 15B.

So, it accurately treats the prefix bytes as a part of one single instruction.

However, I tested dumpbin /disasm and windbg so far, which disassemble the prefix bytes as individual instructions instead of contiguously with the "real" instruction, e.g.

F3
F3
;...
89 ; start of 'real' instruction: mov ebp, esp
E5 

...having evil thoughts already.

Apologies for forgetting the OS's/software's disassembler implementation isn't taking full advantage of processor capabilities (like Windows not implementing Ring2, etc.).

Thanks!