Looking to find the meaning of this statement. From what I understand its comparing 0 with value of EBP register - 9, but I don't understand what the byte ptr does.
-
You need to provide more information about the code. It could be anything. I suggest you to see how this part of memory is initialized.– wiskJan 5, 2019 at 0:08
-
2Hi an welcome to RE.SE. You may want to brush up on assembly. Your question is rather trivial and a look into Intel documentation will give you all the information you need.– 0xC0000022L ♦Jan 6, 2019 at 21:17
Add a comment
|
1 Answer
Let's break this down.
First, we have the mnemonic: cmp
As you state, it performs a compare, though in truth it performs a subtraction (first operand minus the second) without storing the result, but still setting flags.
Next, we have the first operand: byte ptr [EBP-9]
This itself needs to be broken down. EBP-9 is simple math, take the value of the EBP register and subtract nine from it. The square brackets mean to then take that result and treat it like an address to a location in memory. The byte ptr tells you how large of a value to grab from that memory location, in this case a single byte. If it were a word ptr, then you would dereference two bytes (in little-endian byte-order, since this is Intel architecture I think).
And the second operand is a straightforward immediate value: 0
So, all together, that instruction is saying to compare zero with the single byte at address pointed to by EBP-9.
If your next question is "why", then you'll need to look at the other instructions before and maybe after that for context of where EBP is getting its value from (often, though not always, as a base pointer for the current function's stack frame). Sometimes you can tell from just looking at the the disassembly, sometimes it's easier to run it in a debugger and set a breakpoint on or before the instructions you want to inspect.
