title: Monitoring opcode
body: <p>I am trying to monitor the assembly instructions of a functions opcode. I get the functions size in bytes by subtracting a stub address from the functions in memory. I am currently only looking for the mov instruction. When I display the currentByte, it outputs only Ú, which has a hex value of 0xDA, which is FIADD in assembly <a href="http://ref.x86asm.net/coder32.html#xDA" rel="nofollow">http://ref.x86asm.net/coder32.html#xDA</a> Why does no mov instruction display?</p>
  
  <pre><code>#include &lt;iostream&gt;
  #include &lt;Windows.h&gt;
  #include &lt;ctime&gt;
  #include &lt;vector&gt;
  
  #define PUSH 0x50
  #define POP  0x58
  #define MOV  0xB8
  #define NOP  0x90
  #define ADD  0x01
  #define AND  0x21
  #define XOR  0x31
  #define OR   0x09
  #define SBB  0x19
  #define SUB  0x29
  
  using namespace std;
  
  int add(int x, int y)
  {
      int result;
      __asm
      {
          mov eax, x
          add eax, y
          mov result, eax
          xor eax, eax        
      }
      return result;
  }
  
  void stub() { return; }
  
  DWORD GetFunctionSize(DWORD* functionStartAddress, DWORD* stub)
  {
      DWORD dwOldProtect;
      DWORD *func, *stubAddr;
  
      func = (DWORD*)functionStartAddress;
      stubAddr = (DWORD*)stub;
  
      DWORD size = func - stubAddr;
      VirtualProtect(func, size, PAGE_EXECUTE_READWRITE, &amp;dwOldProtect);
      return size;
  }
  
  void GetCurrentByte(PVOID function)
  {
      vector&lt;PBYTE&gt; currByte;
  
      PBYTE pCurrentByte = (PBYTE)function;
      if (*pCurrentByte == MOV)
      {
          cout &lt;&lt; "MOV instr.\n";
      }
      cout &lt;&lt; *pCurrentByte;
      currByte.push_back(pCurrentByte);
  }
  
  int main()
  {
  
      DWORD size = GetFunctionSize((DWORD*)&amp;add, (DWORD*)&amp;stub);
  
      for (int i = 0; i &lt; size; i++)
      {
          GetCurrentByte(add);
      }
      system("pause");
      return 0;
  }
  </code></pre>