2

So I encountered this bit of assembly code:

cmp dword ptr [ECX + 0x24c], DAT_007c6bc0

It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function.

I have compared the output of Ghirda and IDA (free) and in IDA it looks like this:

cmp dword ptr [ecx + 24Ch], offset unk_7C6BC0

Now, what exactly is DAT_007c6bc0? I couldn't really find any information on it, and how does it compare to ECX + 0x24c since it just checks if the address is the same, right?

1

In this example, DAT_007c6bc0 (or offset unk_7C6BC0) is just an address in program's (virtual) address space.

Now, comparing it with [ECX + 0x24c], is comparing this address with the data located at ECX + 0x24c in program's virtual address space, not with ECX + 0x24c. It's just a pointer comparison (dword ptr means that we treat these numbers as dwords - 4bytes each); in pseudo code it could look like this:

if (*(ECX + 0x24c) != DAT_007c6bc0)
    return;

In other words, if d is the data located at DAT_007c6bc0 in memory (d = *DAT_007c6bc0), then the code will check whether data at ECX + 0x24c is a pointer to d.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.