0

Looking to find the meaning of this statement. From what I understand its comparing 0 with value of EBP register - 9, but I don't understand what the byte ptr does.

  • You need to provide more information about the code. It could be anything. I suggest you to see how this part of memory is initialized. – wisk Jan 5 at 0:08
  • 2
    Hi an welcome to RE.SE. You may want to brush up on assembly. Your question is rather trivial and a look into Intel documentation will give you all the information you need. – 0xC0000022L Jan 6 at 21:17
5

Let's break this down.

First, we have the mnemonic: cmp

As you state, it performs a compare, though in truth it performs a subtraction (first operand minus the second) without storing the result, but still setting flags.

Next, we have the first operand: byte ptr [EBP-9]

This itself needs to be broken down. EBP-9 is simple math, take the value of the EBP register and subtract nine from it. The square brackets mean to then take that result and treat it like an address to a location in memory. The byte ptr tells you how large of a value to grab from that memory location, in this case a single byte. If it were a word ptr, then you would dereference two bytes (in little-endian byte-order, since this is Intel architecture I think).

And the second operand is a straightforward immediate value: 0

So, all together, that instruction is saying to compare zero with the single byte at address pointed to by EBP-9.

If your next question is "why", then you'll need to look at the other instructions before and maybe after that for context of where EBP is getting its value from (often, though not always, as a base pointer for the current function's stack frame). Sometimes you can tell from just looking at the the disassembly, sometimes it's easier to run it in a debugger and set a breakpoint on or before the instructions you want to inspect.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.