Want to get 32 bits from 0x8000 adress as 8 bytes

MEM_EXT:00008000                 db 54h
MEM_EXT:00008001                 db 53h, 57h, 20h
MEM_EXT:00008004                 dd 322E3256h, 31332030h, 30303330h, 31313320h, 43432036h
MEM_EXT:00008004                 dd 2F363535h, 20425345h, 865808FAh, 865808FAh, 865808FAh
MEM_EXT:00008004                 dd 865808FAh, 865808FAh, 865808FAh, 865808FAh, 865808FAh
MEM_EXT:00008004                 dd 865808FAh, 865808FAh, 865808FAh, 0FFA735A7h, 962F8E20h
MEM_EXT:00008004                 dd 0DF00F0h, 0DF00FFh, 0AF008Fh, 70002h, 380038h, 0FF000700h
MEM_EXT:00008004                 dd 0, 0, 0

Would this be

0x54 0x53 0x57 0x20 0x32 0x2e 0x32 0x56 ???

How to get further 64 bits, after first 32 bits from 0x8000?

Weird things is that 64 bits as 16 bytes should contain also 0 somwehere

Those should be permutation and S-box key parts

Some more info:

ROM:00000000 ; Processor       : c166 [C165]
ROM:00000000 ; Target assembler: Keil A166 Assembler
ROM:00000000 ; Byte sex        : Little endian

1 Answer 1


In order to change the representation of the data to byte, word(2 bytes), dword(4 bytes) or qword(8 bytes) you can use the following shortcuts after locating the cursor at the needed adress:

  • U: undefines the data, reverts it to bytes
  • D: changes data representation (pressing it on byte makes it short, pressing it on short makes it dword, and then rolls back to byte)
  • Q: changes data representation as qword
  • *: makes data an array of the type of the element you located the cursor at, you can choose the size
  • Y: Assigns a type to an object at a specific address (for example, in your case, it may be BYTE sbox[size], choose size according to the used encryption algorithm)

So in order to make the data at your address look like bytes, you need just to undefine the data at 00008004, this will revert all the group of dwords to bytes. After that you can arrange the rest of the array as you want with the mentioned shortcuts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.