I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening.
I thought that this instruction writes the value 0xdeadbeef into edx:
mov edx, DWORD PTR ds:0xdeadbeef
And I thought that this instruction dereferences that address 0xdeadbeef and writes whatever DWORD value is stored at that address into edx:
mov edx, DWORD PTR ds:[0xdeadbeef]
However, in reality, running this instruction:
mov edx, DWORD PTR ds:0x804bdf4
Results in the value of edx being:
edx = 0xb73fc115
0xb73fc115
is the value that's stored at the address 0x804bdf4
:
x 0x804bdf4
0x804bdf4 <gContents>: 0xb73fc115
So that means that the address was dereferenced, even though the assembly didn't contain any square brackets. I thought thatsquare brackets signified a dereferencing operation. What have I misunderstood?
I'm using GDB
Update: I just tested it on radare2, and it shows the instruction in the format that I would expect
mov edx, dword [obj.gContents]
I also tested it with objdump, and the result was the same as with GDB. I assume it's some sort of syntax I don't currently understand?