CODEWITHSUNDEEP
assemblyx86reverse-engineering
barej
barej

Reputation: 1406

assembly x86 test si

What is the meaning of the following code?

mov si, [L10003248]
test si, si
jnz L10004356

I think it means jump to L10004356 if L10003248 address is not null. I think it does not relate to value stored in L10003248 otherwise it had used word ptr.

Is my assumption correct?

It does not sound logical. Since this jump looks trivial.

I have no information about the compiler.

Upvotes: 1

Views: 307

Answers (2)

user5399561
user5399561

Reputation:

[L10003248] means *L10003248, it's the value stored in address L10003248.

So your code actually means:

si = *L10003248;
if (si != 0)
    jmp L10004356

Upvotes: 2

cadaniluk
cadaniluk

Reputation: 15229

mov si, [L10003248]

does relate to the memory location at L10003248, not just the address. That's uniquely indicated by the square brackets.

[...] otherwise it had used word ptr [...]

No, word ptr doesn't indicate a memory location but the size of the memory location.

Take the instruction

mov [eax], 12h

Now, the assembler can guess what the size of 12h is. Is it 16 bit (0012h)? Or 8 bit (12h)? That needs to be passed as information to the assembler. Here, the ptr directive comes into play:

mov word ptr [eax], 12h

Now, the assembler unambigously knows that 16 bit of data have to copied. Similarly, byte ptr and dword ptr could've been added. For further information on the ptr directive, read this.

Another case can be

mov [16_bit_mem], 12h

Some assemblers (like MASM) memorize the size of a variable, so this instruction compiles fine. OTOH, some (like NASM and GNU as) don't. In NASM, you need to write

mov word ptr [16_bit_mem], 12h

to provide the size of the data to the assembler. GNU as uses the AT&T syntax by default (as opposed to the Intel syntax used by MASM and NASM). Here, you append a suffix (b for byte, w, for word, l for long, and q for quadword) to the mnemonic instead of the ptr directive:

movw 0x12, (16_bit_mem)

That's in AT&T syntax, of course (source and destination operands, swapped, 0x instead of h, etc.).

Upvotes: 2

Related Questions