I'm reversing an x86 binary and I have an instruction that using the at&t syntax is

movl 0xc(%ebp), %eax

while using the intel syntax is

mov eax, dword [ebp+arg_3]

I'm using radare2, and at the start of the function it prints

; arg int arg_0_1      @ ebp+0x1
; arg int arg_3        @ ebp+0xc

Why [ebp+arg_3] instead of a simple substitution like [arg_3]?

  • 1
    your question has a typo - the '-' should be '+'. Jul 29 '16 at 15:36

The reference to ebp makes explicit which register is being used to access the variable, and also the fact that the reference is relative, not absolute. A compiler might have produced an instruction using esp instead, if no stack frame exists, or any other register if the code were written by hand.

Further, to show only [arg_3] implies that the access is equivalent to another memory location such as [401000h], but with a name instead of a number.

  • Could you add a generic expression using the syntax used in the OP? Jul 29 '16 at 15:48
  • 1
    @giuscri it's simply a convention chosen by authors of a disassembler you're using. They seem to simply equate arg3 to 0xc and not bother with details :) If your question is about "; arg int arg_3 @ ebp+0xc" - then yeah I agree it's a bit illogical but hey, ask them to fix it :) Aug 3 '16 at 8:04
  • 2
    hi I am one of the authors, the reason why we made it like this is that many of the arguments/variables manipulating commands requires prior knowledge of that base register you will use, so think of the [ebp+arg_3] as if I was trying to say arg_3 is offsetted with respect to ebp instead of regular + operator
    – oddcoder
    Aug 7 '16 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.