I try to analyze an .exe file and I have always something like that:


I search a lot for that and I know that the expression with [...] means that we store the context of ESI in EAX. For example, when I have in ESI the value 00000101 (5 in decimal), then I would represent it in C like this:

    int x = 5;
    int y = x;

Ok, thats fine, but what if I have an address in ESI ? Something like 001B5355 from which i know that it is an address. How would I represent it then? Maybe use something like a pointer which would point to 001B5355 ?

  UnknownType *immediatePointer = &001B5355;

  UnknownType *pointerEAX = *immediatePointer;

I need help because the whole assembly code of the .exe consists of that kind of lines and I do not know how to represent it to imagine how it could implement it.

2 Answers 2


The instruction


takes the contents of the DWORD pointed to by DS:ESI. If you the value of ESI is known to you and is a constant, you could do it in a single line like this:

unsigned eax = *(unsigned *)0x001B5355;

You can make it a little better by splitting it into two parts (as you have done) so that you can name the pointer.

unsigned *ptr = (unsigned *)0x001B5355;
unsigned eax = *ptr;

This assumes that unsigned is a 32-bit quantity with your compiler.

  • ok, thanks. You mean it is ok when I assume that it is or can be represented by using the pointer principle/concept ? Commented Jun 8, 2014 at 20:40
  • @user3097712: yes, that's correct, but be careful to use the correct syntax as I've shown in these examples.
    – Edward
    Commented Jun 9, 2014 at 11:04

If esi holds 5 mov eax, [esi] will create an access violation as 5 will not be a valid address in normal cases.

and it does not translate to int x = 5 ; int y = x
that is represented by mov eax , esi not mov eax [esi]

pointermagic:\>type pointermagic.cpp

int x = 4;
int *y = &x;
int z = x + *y;
int main (void)
    return z + x;

pointermagic:\>cl /Zi /nologo pointermagic.cpp /link /RELEASE

pointermagic:\>cdb -c "g main; uf @eip;q" pointermagic.exe 

0:000> cdb: Reading initial command 'g main; uf @eip;q'    
00401000 55              push    ebp
00401001 8bec            mov     ebp,esp
00401003 a140bb4000      mov     eax,dword ptr [pointermagic!z (0040bb40)]
00401008 030500b04000    add     eax,dword ptr [pointermagic!x (0040b000)]
0040100e 5d              pop     ebp
0040100f c3              ret

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.