Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am reading through the 'Practical Malware Analysis' book and got to page 74 which says:
lea ebx, [eax*4+4]is the functional equivalent ofebx = (eax+1)* 5whereeaxis a number.
As of my understanding, lea ebx, [eax*4 + 4] should multiply eax value by 4, add 4 to it and then store it back in ebx, which is different than (eax+1) * 5.
Is that a typo? Or I got things wrong?
I think it should be: ebx = (eax+1) * 4
This is a typo. The instruction lea ebx,[eax*4+4] will set ebx to 4*eax+4 or 4*(eax+1).
I believe I found a revision online of that book which has:
For example, it is common to see an instruction such as lea ebx, [eax*5+5], where eax is a number, rather than a memory address. This instruction is the functional equivalent of ebx = (eax+1)*5, ...
so it seems as though it was corrected at some point. Note that, technically, lea ebx, [eax*5+5] is really implemented as lea ebx, [eax*4+eax+5].
