What does mov from hex[eax] mean?

Question

I'm trying to reverse engineering a simple program (learning purpose) using IDA and I got stuck on this instruction:

mov    dl, byte_404580[eax]

This instruction stores in the first 8 bit of EDX a value derived from EAX and byte_404580 but I don't know how it is actually computed.

Looking at byte_404580 is stored the hex value 69h:

.data:00404580 byte_404580     db 69h

Is it the same of [eax+69h] or not?

No, It is similar to array notation.The instruction fetches the byte at an offset of eax from byte_404580 — 0xec, Commented Mar 19, 2016 at 16:55
@ExtremeCoders Good answer, please fill an answer instead of a comment next time so the question can be marked as answered. — ekse, Commented Mar 19, 2016 at 18:53
It's using 00404580+(contents of eax) as the source address (I suppose you're using ATT syntax) — Vitaly Osipov, Commented Mar 21, 2016 at 6:24

Community · Accepted Answer · 2017-05-23 12:37:19Z

2

(Copying the comments of Extreme Coders so the question can be marked as answered.)

It is similar to array notation.The instruction fetches the byte at an offset of eax from byte_404580.

CommunityBot

1

answered Mar 19, 2016 at 18:51

ekse

2,20813 silver badges19 bronze badges

Add a comment |

1 Answer 1