0

I have this assembly code:

XOR DWORD PTR DS:[ECX+EAX],1234567

And what it does is just xoring the first 4 bytes of EAX with 1234567. So if the first 4 bytes are :

31 32 31 32

After xor they become:

56 77 12 33

I tried many xor Calculators to understand how it was xored with no luck any help?

2

What may be confusing you is the fact that memory on x86 processors uses little-endian layout. The four bytes 31 32 31 32, when interpreted as a 4-byte integer (dword), become 0x32313231. If we perform xor operation on it:

0x32313231^0x1234567=0x33127756

And putting 0x33127756 back into little-endian memory order we get:

56 77 12 33
| improve this answer | |
  • Now i understand it much better thank you! – Xozu Apr 14 '17 at 6:34
  • 2
    Then you should accept the answer... – Remko May 13 '17 at 22:14
1

The command you refer to is a good example for CISC architectures:

XOR DWORD PTR DS:[ECX+EAX],1234567

This first add the values of ECX and EAX, then interprets the sum as a memory address and xors the value at that location with 1234567

Also, please note that the EAX register is always 4-byte sized. For less bytes, you may use ax, al or ah and for higher (8-byte) values you may use RAX (on 64 bit systems). Please note these names are referring to sections of the same register.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.