I have this assembly code:

MOV DL,BYTE PTR DS:[ECX+EAX]  --> Move the first byte of EAX to DL
ADD BYTE PTR DS:[EAX+9],DL  --> ADD the DL byte to the ninth byte at EAX
INC ECX --> Increase ECX by one

As you can see i understand everything except of the last line,


What i can understand here is that there is a compersion between 4 bytes that comes from EBP+C to ECX

But i still don't understand that what is that EBP+C?


C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12). This CMP ECX,DWORD PTR SS:[EBP+C] means "compare the content of ECX register with 32 bit from address [ebp + 12].


EBP stands for extended base pointer keeping track of the current stackframe.

Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the stack, the base pointer remebers the value of ESP at the beginning of the function (convention).

For this reason, EBP is often used to referr to arguments or local variables (depending on if you add or substract from it). Remember the stack grows downwards - so positive offsets may referr to arguments passed to the function. Wikipedia offers a great illustration of this layout below:

Wikipedia Stack illustration

  • That is a great explanation thank you ! @Nordwald
    – Xozu
    Apr 13 '17 at 7:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.