2

Here is the functionenter image description here

If I understand correctly:

  • There is a buffer of size 256 bytes created (malloc)
  • in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)
  • the next 32 bits (32 to 63) are set to C8h
  • the next 32 bits (64 to 95) to 0.

Then another pointer of memory size 3200 is created. The address of this new pointer is written in the first buffer between the bit 127 to the bit 127+64=191.

Then we return the address of the first buffer.

Am I right?

Thank you very much!!!

PS: Additional question: why 'rax+1' is to understand as 'rax+8bits ' instead of rax+1bit?

3

If I understand correctly:

There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 bits (32 to 63) are set to C8h the next 32 bits (64 to 95) to 0.

Yes!

The address of this new pointer is written in the first buffer between the bit 127

Well it will be the 128th bit. The qword at rax+0x10 is 128 bits from the head of your first malloc.


But these aren't strictly bit offsets. You can calculate how many bits from the start of memory, but I would question why it matters.

PS: Additional question: why 'rax+1' is to understand as 'rax+8bits ' instead of rax+1bit?

rax is a 64 bit register so you can use it to represent 2^64 values.

If rax is 0x12345678 and I add 1, what should happen? It will become 0x12345679 regardless of how many bits you want that to represent. (Oversimplification but I hope this make the point).

For example: mov dword ptr [rax+4], 0xC8

Ref: https://www.felixcloutier.com/x86/MOV.html

From the above ref, this is a mov m32, imm32 which means copy a 32bit constant into the 32bit DWORD through this pointer [rax+4]

So because [rax+4] represents a pointer to byte addressable memory, the +4 represents 4 bytes.

This is only because the m32 operand to mov is concerned with the address of bytes. There are other x86 instruction that can manipulate bits, but not this one.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.