# Correct my understanding on a basic allocation memory

Here is the function If I understand correctly:

• There is a buffer of size 256 bytes created (malloc)
• in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)
• the next 32 bits (32 to 63) are set to C8h
• the next 32 bits (64 to 95) to 0.

Then another pointer of memory size 3200 is created. The address of this new pointer is written in the first buffer between the bit 127 to the bit 127+64=191.

Then we return the address of the first buffer.

Am I right?

Thank you very much!!!

PS: Additional question: why 'rax+1' is to understand as 'rax+8bits ' instead of rax+1bit?

## 1 Answer

If I understand correctly:

There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 bits (32 to 63) are set to C8h the next 32 bits (64 to 95) to 0.

Yes!

The address of this new pointer is written in the first buffer between the bit 127

Well it will be the 128th bit. The qword at `rax+0x10` is 128 bits from the head of your first `malloc`.

But these aren't strictly bit offsets. You can calculate how many bits from the start of memory, but I would question why it matters.

PS: Additional question: why 'rax+1' is to understand as 'rax+8bits ' instead of rax+1bit?

`rax` is a 64 bit register so you can use it to represent 2^64 values.

If `rax` is `0x12345678` and I add `1`, what should happen? It will become `0x12345679` regardless of how many bits you want that to represent. (Oversimplification but I hope this make the point).

For example: `mov dword ptr [rax+4], 0xC8`

From the above ref, this is a `mov m32, imm32` which means copy a 32bit constant into the 32bit DWORD through this pointer `[rax+4]`

So because `[rax+4]` represents a pointer to byte addressable memory, the `+4` represents 4 bytes.

This is only because the `m32` operand to `mov` is concerned with the address of bytes. There are other x86 instruction that can manipulate bits, but not this one.