I'm trying to reverse engineer an app. I can't understand some instructions:

mov     eax, [ebp+var_4]
movzx   eax, byte ptr [eax+1Ch]      // (1)
mov     edx, [ebp+var_8]
mov     [edx+8], eax
mov     eax, [ebp+var_4]
movzx   eax, byte ptr [eax+1Dh]     // (2)
mov     edx, [ebp+var_8]
mov     [edx+0Ch], eax
mov     eax, [ebp+var_8]
mov     dword ptr [eax+10h], 1F41h  // (3)

Based on reversing other parts of the app, I believe edx+8, edx+0C, edx+10 are all integers; eax+1C is 'scP8B' and eax+1D is 'ocDynamicMR2'.

I don't understand instructions (1) and (2).

  • did you try to look up this instruction in any documentation?
    – Igor Skochinsky
    May 29, 2018 at 9:15
  • If you are using IDA, you can turn on Auto comments, this option will explain some "basic information" for you. The answer for this question is @Henno Brandsma's response!
    – tuantm
    May 30, 2018 at 2:21

1 Answer 1


eax + 0x1c is a pointer to bytes, and the value of the byte at that address is put into the register eax where the byte value is “zero-extended” (hence the movzx), so that e.g. a byte 0xdf would become a dword 0x000000df, so not sign-extended. So in C: eax = (unsigned int) b[0x1c], where unsigned char *b is the pointer stored in var_4, say.

  • A nice link to some place where the questioner could look up opcodes in the future would have been awesome. After all none of this is magic and the question is at the level of "please do my homework".
    – 0xC0000022L
    May 28, 2018 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.