CODEWITHSUNDEEP
assemblyx86disassemblyghidra
eltabre
eltabre

Reputation: 33

What does "=>address" mean in Ghidra's disassembly, at the end of an instruction?

I am new to assembly & Ghidra and I am seeing a => on some lines for PUSH in a binary I am looking at and I cant seem to find what Ghidra is doing for instructions like this:

0040298b 56  PUSH   ESI=>DAT_004046c8

Upvotes: 1

Views: 1369

Answers (1)

Florian Magin
Florian Magin

Reputation: 661

This is Ghidra annotating the assembly because it could statically infer that the value of ESI is OFFSET DAT_004046c8 (from the previous instruction). This is a typical feature for Reverse Engineering tools, so you don't have to mentally keep track of all known values and the meaning of a certain offset yourself. This becomes especially if you rename the location DAT_004046c8 to something more meaningful like custom_variable_name(once you found out what the "real" variable name could have been), the disassembly will show

0040298b 56  PUSH   ESI=>custom_variable_name

Upvotes: 4

Related Questions