0

I'm trying to reverse engineering a simple program (learning purpose) using IDA and I got stuck on this instruction:

mov    dl, byte_404580[eax]

This instruction stores in the first 8 bit of EDX a value derived from EAX and byte_404580 but I don't know how it is actually computed.

Looking at byte_404580 is stored the hex value 69h:

.data:00404580 byte_404580     db 69h

Is it the same of [eax+69h] or not?

  • No, It is similar to array notation.The instruction fetches the byte at an offset of eax from byte_404580 – 0xec Mar 19 '16 at 16:55
  • Also check this – 0xec Mar 19 '16 at 16:57
  • @ExtremeCoders Good answer, please fill an answer instead of a comment next time so the question can be marked as answered. – ekse Mar 19 '16 at 18:53
  • It's using 00404580+(contents of eax) as the source address (I suppose you're using ATT syntax) – Vitaly Osipov Mar 21 '16 at 6:24
2

(Copying the comments of Extreme Coders so the question can be marked as answered.)

It is similar to array notation.The instruction fetches the byte at an offset of eax from byte_404580.

Related question : https://stackoverflow.com/questions/12148010/understanding-x86-mov-syntax

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.