ive started studying reverse engineering, and in a binary i am trying to reverse i stumbled upon an unusual(to me) line of assembly in IDA PRO. and it looks like this

.text:00000000008A1C21                 mov     r8d, ds:(off_8A40FC - 400000h)[rcx+rax*4]

so i know that it moves something into the r8 register which is the size of a dword, but i do not understand what it moves into it ? something from the data segment, but im clueless as of how to interpret it, any help would be great.

  • in general, it is good to provide additional information about the context an instruction is found in, not just the instruction itself. – julian Feb 20 '18 at 19:03

What the assembly is doing is subtracting 0x400000 from the offset 0x8A40FC giving 0x4A40FC, then using the new address at memory address [rcx+rax*4]. I recommend studying the assembly more, this is a bad question as its not giving full detail on what rcx, and rax is.

Happy hacking! :-)

  • Yeah im still pretty new to this and understand basic assembly, this particular instruction was early on in a function i am reversing so i don't know what rcx and rax is. – Flauen Feb 20 '18 at 19:18
  • so another way of writing this could be [rcx + rax * 4 + 0x4A40FC] ? – Flauen Feb 20 '18 at 19:24
  • No, that index is at that specific point. With the code you provided you would be at that index, not [rcx+rax*4] . And no problem!! I'm happy to see you learning :-) – Graham Best Feb 20 '18 at 19:27
  • Also, I suggest marking this answer as the accepted answer as it solved your problem (hopefully) – Graham Best Feb 20 '18 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.