Understanding a specific assembly line

Question

I try to analyze an .exe file and I have always something like that:

MOV EAX, DWORD PTR DS:[ESI]

I search a lot for that and I know that the expression with [...] means that we store the context of ESI in EAX. For example, when I have in ESI the value 00000101 (5 in decimal), then I would represent it in C like this:

    int x = 5;
    int y = x;

Ok, thats fine, but what if I have an address in ESI ? Something like 001B5355 from which i know that it is an address. How would I represent it then? Maybe use something like a pointer which would point to 001B5355 ?

  UnknownType *immediatePointer = &001B5355;

  UnknownType *pointerEAX = *immediatePointer;

I need help because the whole assembly code of the .exe consists of that kind of lines and I do not know how to represent it to imagine how it could implement it.

Answer 1

The instruction

MOV EAX, DWORD PTR DS:[ESI]

takes the contents of the DWORD pointed to by DS:ESI. If you the value of ESI is known to you and is a constant, you could do it in a single line like this:

unsigned eax = *(unsigned *)0x001B5355;

You can make it a little better by splitting it into two parts (as you have done) so that you can name the pointer.

unsigned *ptr = (unsigned *)0x001B5355;
unsigned eax = *ptr;

This assumes that unsigned is a 32-bit quantity with your compiler.

Answer 2

If esi holds 5 mov eax, [esi] will create an access violation as 5 will not be a valid address in normal cases.

and it does not translate to int x = 5 ; int y = x
that is represented by mov eax , esi not mov eax [esi]

pointermagic:\>type pointermagic.cpp

int x = 4;
int *y = &x;
int z = x + *y;
int main (void)
{
    return z + x;
}

pointermagic:\>cl /Zi /nologo pointermagic.cpp /link /RELEASE

pointermagic:\>cdb -c "g main; uf @eip;q" pointermagic.exe 

0:000> cdb: Reading initial command 'g main; uf @eip;q'    
pointermagic!main:
00401000 55              push    ebp
00401001 8bec            mov     ebp,esp
00401003 a140bb4000      mov     eax,dword ptr [pointermagic!z (0040bb40)]
00401008 030500b04000    add     eax,dword ptr [pointermagic!x (0040b000)]
0040100e 5d              pop     ebp
0040100f c3              ret
quit: