0

I came across the following instruction in IDA:

movsx edx, byte_407030[ecx]

byte_407030 is 25h. Is it trying to access some memory location? I know that ecx is storing a counter in a for loop.

3

Lets go step by step:

movsx

This is a specialized move instruction it moves a value from source of a smaller size (in your case, a byte) to a destination of a potentially larger size (in your case, a double word), preserving the sign bit by an operation called sign-extending.

This means that if the byte was a negative integer then the destination will also be a negative integer. This is a bit more complex then simply copying the last bit because of the way negative integers are encoded (which is called two's complement).

edx 

The first operand of a mov instruction is the destination target. In this case it's the double-word register edx. This is were the data is moved to.

byte_407030[ecx]

The second operand is the source operand. This is where the data is moved from. Please note that although the instruction is mov, the value also remains in the source location. Calling it "copy" might have been a better idea ;).

IDA's syntax here is similar to C's syntax. This will dereference the memory region at address 0x407030 plus the value of ecx and fetch a byte from there. In case ecx is 11h, the final address would be 0x407041.

summary
This instruction will take the byte value at memory address of 0x407030+ecx, sign extend it to dword (4 bytes in most architectures) and assign that final value into register edx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.