Windows 10, IDA Home, 64bit application compiled with Visual Studio.

I'm reverse engineering a crackme and i found this instruction :

  mov     cl, byte_51B000[eax]
  mov     byte_51B018[edx], cl 

in these 2 byte_ location are null terminated strings.

I'm not sure to understand exactly what it's doing. Is it like an array index where byte_* is the array and [eax/edx] is the index ? i can't find this kind of syntax anywhere, is it IDA specific ?

  • 1
    This indeed is the same as [eax+byte_51B000]. – Jongware Oct 21 '20 at 12:49
  • @usr2564301 thank you :) – ker2x Oct 21 '20 at 13:37
  • 1
    Not adding an answer because I do not know if this is an IDA specific idiom. But – from memory – you can change the display using the hotkey for "Change offset type" (usually o). – Jongware Oct 21 '20 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.