I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know how it should be read]
Thanks, R.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityLEA
means "Load Effective Address", i.e. instead of loading into the EAX register the content at the address ESP+8, it loads directly the address, i.e. the content of the register ESP increased by 8.
For illustration, if in the ESP register (Extended Stack Pointer) is the value 1000, the situation may be as this:
Then your instruction LEA EAX, [ESP+8]
loads into the EAX register the number 1008 — the address of the 3rd value in the stack.
In other words, the EAX will contain the address (a pointer) to the value 531.
Compare:
If you replace the LEA
instruction with the MOV
one:
LEA EAX, [ESP+8] ; original (LEA): EAX = 1008
MOV EAX, [ESP+8] ; replaced (MOV): EAX = 531
then the EAX register will be loaded with the value in the stack, i.e. 531.
Notes:
Why a pointer into stack?
Because arguments of functions are generally put into the stack.
So in your code you probably obtained a pointer to the particular (2nd ?) argument.
What the part EAX => local_18
means?
Ghidra's decompiler (to C language) doesn't know the original instructions (and variable names), so it creates names as your local_18
.
In the listing (disassembly) EAX => local_18
means something as:
“In this location, your variable
local_18
is used in the form of the EAX register”.
(This variable is not in the memory — its value is directly in the EAX register.)
local_18
has nothing with this instruction, it's only the Ghidra's hint (meaning that the result (108) will be saved in the variable local_18
).