1

Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very difficult for me to 'just google'. So I have to ask you lovely people.

Below are the instructions

mov     ecx, [esp+10h+arg_0]
...
...
mov     [esp+10h+arg_8], eax
...
...
and     al, 0E0h

Are arg_0 and arg_8 arguments supplied to the program at runtime or arguments supplied to a function within the program? Also please help me understand what 0E0h is in the last instruction. Is that a function, memory address, or hex value? Thank you.

1 Answer 1

0

the first instruction is a read
the second instruction is a write
the third instruction is a compare

arg0 , arg_8 are arguments provided to the function and is provided by the caller like

call xyz(arg0,arg1....argn);

normally arguments provided to a function are not modified unless the argument is a pass by reference

for understanding opcodes operation you must understand

  1. how an opcode works
  2. what are its operands ,
  3. how many operands does it take
  4. what is result of the operation
  5. which flags are affected
  6. what exceptions are raised
  7. what is the mode in which this opcode can be used
  8. are there any bitwise exceptions
  9. are there modifiers to the opcode
  10. Compatibility etc these are all described in intel / amd manuals
    or you can use any online reference like reference for and opcode

if you go through the linked reference you will understand that the operand can be an immediate (constant value , [imm8 , imm16 , imm32 )
or register (al...,r8 or ax...,r16 or eax...,r32)
or memory (byte,m8 or word , m16 or dword , m32)

based on the description infer the type of your operand 0E0h

3
  • Thanks for the response. One thing that is still unclear to me: I am used to seeing hex in pair I.E. 68 69. But 0E0 is 3 characters? I suppose 0E is one pair and 00 would be the other pair?
    – guest1
    Nov 18, 2022 at 2:15
  • 0e0h is a single hex constant denoting 14 decimal h denotes it is a hex and by convention a 0 is added by many tools to all of the 0a0h,0b0h,0c0h,0d0h,0e0h,0f0h also some tools (gas iirc needs a #0e0h ) (some discussion about leading zeros for reference)[stackoverflow.com/questions/58061348/…
    – blabb
    Nov 18, 2022 at 12:30
  • and is not a comparison but a bitwise... and. 0e0h is not 14 but 224.
    – user33885
    Dec 5, 2022 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.