1

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know how it should be read]

Screenshot of the disassembly in Ghidra

Thanks, R.

2

LEA means "Load Effective Address", i.e. instead of loading into the EAX register the content at the address ESP+8, it loads directly the address, i.e. the content of the register ESP increased by 8.

For illustration, if in the ESP register (Extended Stack Pointer) is the value 1000, the situation may be as this:

enter image description here

Then your instruction LEA EAX, [ESP+8] loads into the EAX register the number 1008the address of the 3rd value in the stack.

In other words, the EAX will contain the address (a pointer) to the value 531.

Compare:

If you replace the LEA instruction with the MOV one:

LEA EAX, [ESP+8]    ; original (LEA): EAX = 1008
MOV EAX, [ESP+8]    ; replaced (MOV): EAX =  531

then the EAX register will be loaded with the value in the stack, i.e. 531.


Notes:

  1. Why a pointer into stack?
    Because arguments of functions are generally put into the stack.
    So in your code you probably obtained a pointer to the particular (2nd ?) argument.

  2. What the part EAX => local_18 means?

    Ghidra's decompiler (to C language) doesn't know the original instructions (and variable names), so it creates names as your local_18.

    In the listing (disassembly) EAX => local_18 means something as:

    “In this location, your variable local_18 is used in the form of the EAX register”.

    (This variable is not in the memory — its value is directly in the EAX register.)

4
  • Do you mean that the address of [ESP + local_18] is loaded into EAX, and ESP is increased by 8? [I'm rephrasing what you said for clarification] Jun 27 at 14:27
  • No, ESP itself is not increased. For example, if in the ESP is the number 100, then after performing the highlighted instruction in the EAX registry will be 108 and in the ESP still 100. local_18 has nothing with this instruction, it's only the Ghidra's hint (meaning that the result (108) will be saved in the variable local_18).
    – MarianD
    Jun 27 at 14:35
  • This is what I'm seeing: LEA EAX=>local_18, [ESP + 0x8] I don't understand where the [ESP + 0x8] comes from and I don't understand what the "EAX => local_18" shows Jun 27 at 14:48
  • I extended my answer with an illustration and the description.
    – MarianD
    Jun 27 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.