I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know how it should be read]
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
LEA means "Load Effective Address", i.e. instead of loading into the EAX register the content at the address ESP+8, it loads directly the address, i.e. the content of the register ESP increased by 8.
For illustration, if in the ESP register (Extended Stack Pointer) is the value 1000, the situation may be as this:
Then your instruction
LEA EAX, [ESP+8] loads into the EAX register the number 1008 — the address of the 3rd value in the stack.
In other words, the EAX will contain the address (a pointer) to the value 531.
If you replace the
LEA instruction with the
LEA EAX, [ESP+8] ; original (LEA): EAX = 1008 MOV EAX, [ESP+8] ; replaced (MOV): EAX = 531
then the EAX register will be loaded with the value in the stack, i.e. 531.
Why a pointer into stack?
Because arguments of functions are generally put into the stack.
So in your code you probably obtained a pointer to the particular (2nd ?) argument.
What the part
EAX => local_18 means?
Ghidra's decompiler (to C language) doesn't know the original instructions (and variable names), so it creates names as your
In the listing (disassembly)
EAX => local_18 means something as:
“In this location, your variable
local_18is used in the form of the EAX register”.
(This variable is not in the memory — its value is directly in the EAX register.)