I'm having trouble understanding this specific notation in Ghidra

Question

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know how it should be read]

Thanks, R.

Answer 1

LEA means "Load Effective Address", i.e. instead of loading into the EAX register the content at the address ESP+8, it loads directly the address, i.e. the content of the register ESP increased by 8.

For illustration, if in the ESP register (Extended Stack Pointer) is the value 1000, the situation may be as this:

Then your instruction LEA EAX, [ESP+8] loads into the EAX register the number 1008 — the address of the 3^rd value in the stack.

In other words, the EAX will contain the address (a pointer) to the value 531.

Compare:

If you replace the LEA instruction with the MOV one:

LEA EAX, [ESP+8]    ; original (LEA): EAX = 1008
MOV EAX, [ESP+8]    ; replaced (MOV): EAX =  531

then the EAX register will be loaded with the value in the stack, i.e. 531.

---

Notes:

1. Why a pointer into stack?
   Because arguments of functions are generally put into the stack.
   So in your code you probably obtained a pointer to the particular (2^nd ?) argument.

2. What the part EAX => local_18 means?

   Ghidra's decompiler (to C language) doesn't know the original instructions (and variable names), so it creates names as your local_18.

   In the listing (disassembly) EAX => local_18 means something as:

   “In this location, your variable local_18 is used in the form of the EAX register”.

   (This variable is not in the memory — its value is directly in the EAX register.)