I came across the following instruction in IDA:
movsx edx, byte_407030[ecx]
25h. Is it trying to access some memory location? I know that
ecx is storing a counter in a for loop.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Lets go step by step:
This is a specialized move instruction it moves a value from source of a smaller size (in your case, a byte) to a destination of a potentially larger size (in your case, a double word), preserving the sign bit by an operation called sign-extending.
This means that if the byte was a negative integer then the destination will also be a negative integer. This is a bit more complex then simply copying the last bit because of the way negative integers are encoded (which is called two's complement).
The first operand of a
mov instruction is the destination target. In this case it's the double-word register
edx. This is were the data is moved to.
The second operand is the source operand. This is where the data is moved from. Please note that although the instruction is
mov, the value also remains in the source location. Calling it "copy" might have been a better idea ;).
IDA's syntax here is similar to C's syntax. This will dereference the memory region at address
0x407030 plus the value of
ecx and fetch a byte from there. In case
11h, the final address would be
This instruction will take the byte value at memory address of
0x407030+ecx, sign extend it to dword (4 bytes in most architectures) and assign that final value into register