I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line

Mov dword PTR [ESP] => local_70 , eax

I get we are moving eax into the left side but I'm not sure what the [ESP]=>local_70 chunk is as I haven't come across that before. I think the => confuses me the most.

Any help is much appreciated!

  • local_70 is simply a variable name.
    – fpmurphy
    Feb 8 '20 at 6:20

I've disassembled one of my programs and it seems that mem/reg => value just means that value was moved to mem/reg.

So, in your example, mov dword PTR [ESP] => local_70 , eax is just mov dword PTR [ESP], eax, but Ghidra knows that the value at rax is local_70 (it was probably set few lines above that instruction), so it displays this information for you.

Tip: When in doubt what some particular instruction means, you can right click on that instruction and select Instruction info... option to know what it really does.

  • 1
    Instruction info... is going to provide more information on the SLEIGH pieces, but not really what they do. If you install manuals in correct locations you can Processor Manual... which should load to the page
    – mumbel
    Feb 12 '20 at 15:11
  • "but Ghidra knows that the value at rax is local_70" Is that a mistake (shouldn't it be ESP instead of rax? Sep 7 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.