CODEWITHSUNDEEP
assemblyx86
user3097712
user3097712

Reputation: 1675

Use of Shl in assembly

I have the following piece of lines and I do not understand that. Hope that someone can help me:

.....
MOV EAX, DWORD PTR SS:[EBP-0x4]
SHL EAX, 0x2
ADD EAX, DWORD PTR SS:[EBP-0x8]
PUSH EAX
....

Normally, it helps me to translate that into C language. But somehow I cant find a way to do it in that case. So, I only know that in the second line with SHL the register is multiplied by 4. And that the DWORD PTR SS:[EBP-0x4] looks like an array representation but i am not sure.

I also find the following link

x86 Assembler: shl and other instructions

But I dont understand the answer there. So my question would be: What it is going on there? Thx...

Upvotes: 2

Views: 16606

Answers (2)

Chris Taylor
Chris Taylor

Reputation: 53699

[EBP-0x4] means access the content of memory at the address [EBP-0x4], EBP is the base register, so for example if the value in EBP is 16 then you would be reading the value from memory at address [16-4] i.e. at address 12. (I used simple numbers, these addresses will cause an access violation).

This is like dereferencing a pointer in C/C++. (But values at fixed offsets from EBP are usually just plain variables like int x; the frame pointer is something the compiler invents behind the scene to address automatic storage, not a C int*.)

The DWORD PTR modifier tells the assembler to generate the opcode that will move 4 bytes from memory to EAX. The SS: prefix just says that the address is relative to the stack segment, but you can ignore x86 segmentation entirely because 32 and 64-bit OSes use a flat memory model where all the segments have base=0. The SS: is really just printed in disassembly as a reminder that it's implied by using EBP as the base register in the addressing mode.

The rest of the explanation is in the code as comments.

; Load the 4 byte (DWORD) value from address EBP-0x4 relative to the stack segment 
; into the EAX register
MOV EAX, DWORD PTR SS:[EBP-0x4]

; Shift the value in the EAX register left 2 bits. In pseudo C  EAX <<= 2
SHL EAX, 0x2

; Add the DWORD value at address (value in EBP register)-0x8 
; to the value in EAX and store the result in EAX
ADD EAX, DWORD PTR SS:[EBP-0x8]

; Push the value of EAX onto the stack
PUSH EAX

The reason it is quite common to see [EBP-xxx] is that that variables local to the function are accessed relative to the base register, especially in debug builds. So this could be something like x + y*4.

(This can include function args that were passed in registers, e.g. with a fastcall calling convention; debug builds will spill them to the stack along with local variables to make sure they have an address.)

push eax indicates that this value is probably then passed as an argument to another function call, but we can't see the rest of the function to know which one.

I hope this helps you get started.

Upvotes: 4

user3709120
user3709120

Reputation: 55

  a = 00001 = 1
  shift 1 bit to the left
  a = 00010 = 2
  shift 1 bit to the left
  a = 00100 = 4
  each time you shift to the left you multiply
  another example:
  a = 00011 = 3
  shift to the left 1 bit 
  a = 00110 = 6
  as you can see shifting to the left multiply by 2
  SHL EAX, 0x2 ;multiply by 4 because it shifts 2 bits to the left.

Upvotes: 2

Related Questions