I have this assembly code:


And what it does is just xoring the first 4 bytes of EAX with 1234567. So if the first 4 bytes are :

31 32 31 32

After xor they become:

56 77 12 33

I tried many xor Calculators to understand how it was xored with no luck any help?

2 Answers 2


What may be confusing you is the fact that memory on x86 processors uses little-endian layout. The four bytes 31 32 31 32, when interpreted as a 4-byte integer (dword), become 0x32313231. If we perform xor operation on it:


And putting 0x33127756 back into little-endian memory order we get:

56 77 12 33
  • Now i understand it much better thank you!
    – Xozu
    Apr 14, 2017 at 6:34
  • 2
    Then you should accept the answer...
    – Remko
    May 13, 2017 at 22:14

The command you refer to is a good example for CISC architectures:


This first add the values of ECX and EAX, then interprets the sum as a memory address and xors the value at that location with 1234567

Also, please note that the EAX register is always 4-byte sized. For less bytes, you may use ax, al or ah and for higher (8-byte) values you may use RAX (on 64 bit systems). Please note these names are referring to sections of the same register.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.