Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have this assembly code:
XOR DWORD PTR DS:[ECX+EAX],1234567
And what it does is just xoring the first 4 bytes of EAX with 1234567. So if the first 4 bytes are :
31 32 31 32
After xor they become:
56 77 12 33
I tried many xor Calculators to understand how it was xored with no luck any help?
What may be confusing you is the fact that memory on x86 processors uses little-endian layout. The four bytes 31 32 31 32, when interpreted as a 4-byte integer (dword), become 0x32313231. If we perform xor operation on it:
0x32313231^0x1234567=0x33127756
And putting 0x33127756 back into little-endian memory order we get:
56 77 12 33
The command you refer to is a good example for CISC architectures:
XOR DWORD PTR DS:[ECX+EAX],1234567
This first add the values of ECX and EAX, then interprets the sum as a memory address and xors the value at that location with 1234567
Also, please note that the EAX register is always 4-byte sized. For less bytes, you may use ax, al or ah and for higher (8-byte) values you may use RAX (on 64 bit systems). Please note these names are referring to sections of the same register.
