Question about LEA instruction

Question

i'm learning to reverse engineer. So i'm coding some programs and try to understand their assembly. I stumbled upon a curious case and i think i can't solve it alone.

Here's the c code:

 #include <stdio.h>

int main(){

char *texto = "O numero e %d\n";
int i = 10;

while(i){
    printf(texto, i--);
}

return 0;
}

The assembly produced by IDA is the following:

mov     eax, [esp+28]
lea     edx, [eax-1] ; The part i don't understand
mov     [esp+28], edx
mov     [esp+4], eax
mov     eax, [esp+18h]
mov     [esp], eax      ; char *
call    _printf

What i could understand is that it stores the old value in eax and pushes to stack(I purposedly didn't turn on optimizations) and then it pushes the format. While that happens in the middle it does the i--, but i can't understand how it's working. So it get's the address of eax-1 and stores in edx and then stores it in i, but eaxdoesn't hold an address but a value.

Thanks in advance.

Answer 1

What you're seeing is an efficiency trick that compilers like to use.

Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (Or 64 bit, if you're using newer architecture, but as your register names start with e, you're using 32 bit).

The lea instruction loads the address of its operand, instead of the operand itself. In C terms, you could look at [eax-1] as *(eax-1), and lea adds a & operator to that, so lea edx, [eax-1] is like edx = &(*(eax-1)). Which is the same as eax-1 of course.

The compiler could have done exactly the same using the instruction sequence mov edx, eax; sub edx, 1 or mov edx, eax; dec edx. So, why did it use the lea instruction?

The answer is that, historically, resolving addresses in lea was done using dedicated address bus hardware and bypassed the ALU. Also, pipelining had its issues when the same register was used twice in subsequent operations. Which means, on older processors, using lea was a few cycles faster than the alternatives, and it's not hard to implement in the compiler, so this is what compilers traditionally did.

On new processors, the distinction "lea uses separate hardware" isn't (neccesarily) made any more, and pipelining is a lot more intelligent than it used to be, so i doubt it's make any difference these days. But it's still in the compilers, and won't get removed from them because there's just no good reason to.

Answer 2

According to Intel the LEA instruction is:

This instruction computes the effective address of the second operand (the source operand) and stores it in the first operand (destination operand). The source operand is a memory address (offset part) specified with one of the processors addressing modes; the destination operand is a general-purpose register.

So, the lea edx, [eax-1] computes the address of [eax-1], which is eax-1, because [] means that the operand should be handled as an address. After it the address will be stored in edx.