0

in file i find

mov rcx,qword ptr ds:[404320]

when I wanted to see what is at the address 404320 i press "follow in dump" and i got a choice between "constant: file.0000000000404320" and "value: [0000000000404320]" and if i press constant, i see:

0000000000404320  30 2D 40 00 00 00 00 00 00 00 00 00 00 00 00 00  0-@.............  

"30 2D 40 00 00 00 00 00" highlighted

if i press value, i see:

0000000000402D30  FF FF FF FF FF FF FF FF D2 15 40 00 00 00 00 00  ÿÿÿÿÿÿÿÿÒ.@.....  
0000000000402D40  20 2D 40 00 00 00 00 00 00 00 00 00 00 00 00 00   -@.............  

"D2 15 40 00 00 00 00 00 20 2D 40 00 00 00 00 00" highlighted

please can you explain the difference between a value and a constant? I am new to this topic. just in case, i know assembler. and if not enough information has been provided tell me.

1
  • The first one, shows the memory contents at the address of the constant. The latter, first take the value at the memory address pointed by the constant and shows the memory at that location. Jan 11, 2022 at 22:06

1 Answer 1

0

"Constant" in this case does not refer to the common programming term "a value that should not be altered by the program during normal execution"

In this scenario "constant" means the memory address is directly holding the value of the variable.

The "value" term means the memory address is pointing to another memory address, and that 2nd memory address is pointing to the value.

You can see this as the memory address for the "value" follow is 00 40 2D 30 which is the value shown in the "constant" follow 30 2D 40 00 The order of numbers is reversed due numbers being stored in little endian format.

To fully understand whether this is a "constant" or a "value" data type would need to see the complete function and how the rcx value gets used.

For a simple example let's take this C code:

int main()
{
    int v = 128;
    int i = v;
    int *j = &i;
    
    i=i+2;
    *j = i+4;
    return 0;
}

Here we can think of "i" as being the "constant" which is when the memory address representing "i" contains the actual value.

However, the memory address representing "j" is type "value" pointing to another memory address that contains the actual value. In real programs these "value" types will often point to complicated structures, which can require a detailed analysis of how it is used to work out the original data types.

In this simplistic example the assembly is something like this:

sub     rsp, 24
mov     DWORD PTR v$[rsp], 128                    ; 00000080H
mov     eax, DWORD PTR v$[rsp]
mov     DWORD PTR i$[rsp], eax
lea     rax, QWORD PTR i$[rsp]
mov     QWORD PTR j$[rsp], rax
mov     eax, DWORD PTR i$[rsp]
add     eax, 2
mov     DWORD PTR i$[rsp], eax
mov     eax, DWORD PTR i$[rsp]
add     eax, 4
mov     rcx, QWORD PTR j$[rsp]
mov     DWORD PTR [rcx], eax
xor     eax, eax
add     rsp, 24
ret     0

Here we see the example of the "constant"

mov     eax, DWORD PTR i$[rsp]
add     eax, 2
mov     DWORD PTR i$[rsp], eax

We can see the value at memory address $i[rsp] is loaded into eax, 2 is added to it, then the value is directly stored back in the memory address via

mov DWORD PTR $i[rsp], eax

In this case we would use the "constant" follow on DWORD PTR $i[rsp] to find the value.

However, with j we are instead getting a memory address held at $j[rsp] which points to the memory location of i. Instead of updating DWORD PTR $j[rsp] this time we are instead setting the value at the memory location held there.

mov     eax, DWORD PTR i$[rsp]
add     eax, 4
mov     rcx, QWORD PTR j$[rsp]
mov     DWORD PTR [rcx], eax

In this scenario we would use the "value" follow on $j[RSP] to find the value.

1
  • Thank you so much!
    – iko
    Jan 12, 2022 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.