CODEWITHSUNDEEP
assemblyx86
dl11
dl11

Reputation: 5

MOV instruction modify pointer

I'm new to asm and I'm asking myself these (simple) questions: If I have an array in esp, and I write this:

mov ebx,[esp + 0x10]
mov edx,[esp + 0x10]

Will edx have the same value as ebx?

And concerning lea (I saw that there was a lot of subject there so it's just to check if I understood correctly ^^), if I do:

lea ebx, [esp + 0x8c]
and ebx, 0x4

The and affects the address of ebx or the value it points to?

And my last question (still about lea), if I do:

lea edx, [esp, 0x10]
movzx ecx, [edx-0x5]

The mov subtracts 5 from the address or again from the value to which edx points?

Upvotes: 0

Views: 249

Answers (1)

JCWasmx86
JCWasmx86

Reputation: 3583

Will edx have the same value as ebx?

Yes, as you move the same value into edx and ebx.

The and affects the address of ebx or the value it points to?

The and will apply the AND operation to the address esp + 0x8c.

The mov subtracts 5 from the address or again from the value to which edx points?

The addressing mode subtracts five from the number in edx, creating an address. The byte or 2-byte chunk of memory at this location is a source operand for movzx, which loads and zero-extends it. (You forgot to specify the source operand size, so this wouldn't actually assemble.)

mov just copies data without mutating it; you can think of the address math as happening first; addressing modes work the same for all instructions. (With LEA as a special case that doesn't dereference the address.)

As an example for the last question:

uintptr_t edx = 0x10 + (uintptr_t)esp;
uint32_t ecx = *(uint8_t*)(edx-0x5);

Or as C code:

char* someChars=malloc(32);
//Fill someChars

uint8_t* edx = &someChars[0x10];
uint32_t ecx = edx[-5];       // ==someChars[11]

Upvotes: 2

Related Questions