0

I debug a program with IDA, it have a part of code that i don't understand

loc_8048E30:                            ; CODE XREF: phase_6+9Ej
.text:08048E30 mov     esi, [esi+8]
.text:08048E33 inc     ebx
.text:08048E34 cmp     ebx, eax
.text:08048E36 jl      short loc_8048E30   

line 1: mov esi, [esi+8] when I debug address of esi is 0x804B260 so esi+8 is 0x804B268.

The value in [esi+8] is 60h so after mov esi, [esi+8], the value in esi is 60h but it really is 0x804B260. Why it is 0x804B260?

And when esi is named .data:node2, it is linked link?

enter image description here enter image description here

1 Answer 1

2

The instruction mov esi, [esi + 8] copies 4 bytes (DWORD) of data at the location pointed to by esi + 8to register esi.

In your case esi is 0804B260 so it copies 4 bytes from 0804B268. Since x86_64 is little endian the least significant byte as per the screenshot 1 is 0x60. The remaining three bytes are located below (not in the picture).

It is named node2 as it is an exported symbol.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.