Normally, in x86, to load a pointer to a null-terminated string you would use
MOV EDX, OFFSET ds:mystring
In x64, however, I noticed that the compiler does it like this
lea rdx, OFFSET FLAT:$mystring ; 'it is ten'
Why is that?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
If you disassemble the instructions for
mov edx, offset ds:mystring
lea rdx, offset ds:mystring
You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization!
Or, it could be the compilers way of addressing pointer arithmetic in an easier manner.
Check out this for more info on both.