I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.

1. mov     [rsp+78h+arg_0], rsi
2. mov     rsi, cs:qword_1F39B60
3. mov     [rsp+78h+arg_38], rsi
  1. If line 2 is loading 1F39B60 in rsi or the contents of 1F39B60 in rsi?
  2. Would lea rsi, [qword_1F39B60] be the same?
  3. If non bracket using mov action on a memory even allowed or this is just a visual IDA thing?
  4. Can you explain to me why it shows cs: even though qword_1F39B60 is in the .data segment? Shouldn't it be ds:?

Last but not the least this isn't directly connected to my main question but is rsp+78h a fancy way of saying rbp by the disassembler?

1 Answer 1

  1. rsi is being copied into arg_0
  2. lea rsi, [qword_1F39B60] means rsi would contain a pointer to qword_1F39B60
  3. Yes it is allowed, it's a mem->reg operation.
  4. I believe that ds and ss are usually set to zero when using 64bit mode, but cs is set to the start of the text segment, so is the only segment register that can be used to generate a valid address. (There are some conflicting views on this, and I may be wrong)
  5. Usually rbp will be set to rsp before space is allocated on the stack:
push rbp              ; save the current frame pointer
mov rbp, rsp          ; create a new frame
sub rsp, rax          ; allocate space on the stack

However, it looks like this program is optimised (omit frame pointers) and is using rsp for all references, so rbp may be used for anything in this case but not its usual job.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.