8
votes
What is the difference between MOV and LEA in example?
lea = address
mov = contents
if address 0x401000 contains 0xDeadBeef like ef be ad de
lea MySecretPlace, [401000] MySecretPlace will be 0x401000
Mov MySecretPlace, [401000] MySecretPlace will be ...
- 16.7k
5
votes
Accepted
What's the meaning of dword_XXXX and offset dword_XXXX in IDA?
I think I figured out what's going on.
The opcodes for the printing were (assuming dword_AAAAAAAA instead of general dword_XXXX):
FF 35 AA AA AA AA push dword_AAAAAAAA; otherPointer
68 AA AA AA ...
- 175
5
votes
Accepted
NASM, MASM, Intel, AT&T' syntax?
You are confusing several things.
nasm, masm and gas (GNU Assembler) are tools that compile an x86 assembly text file into an executable. Each of them do have a specific syntax to specify your ...
- 19.2k
5
votes
Accepted
Objective-C disassembling - I dont understand this code
The instructions
mov qword [rbp - 16], rax
mov rax, qword [rbp - 16]
are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If ...
- 1,341
3
votes
Accepted
Working Linux assembly XOR Encoder/Decoder Failing on Windows
There are few issues with your code.
1st is what Igor mentioned - .text section is RO. This was solved in this answer.
The 2nd is that you did not copy correctly the bytes or lost some of them in ...
- 4,952
3
votes
far jump do not point to instruction?
first of all you have a 32bit binary and you are debugging it on a 64 bit system
see the wow64 symbol
it means you are looking at some kind of in-between
it means the far jump is pointing to a ...
- 16.7k
3
votes
What is the difference between MOV and LEA in example?
Warning: Illegal instruction used for explanation.
If you are wondering if mov can do the work of lea,
mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax.
However, mov eax, esp+4 is not ...
- 153
3
votes
What is the difference between MOV and LEA in example?
This is basic. Assume that rpb has a value of 55h (Assembler syntax). then
lea rax, [rbp-50h]
would result in 5.
On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
- 1,974
2
votes
What is the difference between MOV and LEA in example?
The difference is that lea only calculates the address while mov actually moves the data. If you know C or C++, it’s somewhat similar to:
Lea:rax = rbp + 0x50;
Mov: rax = rbp[0x50];
(Not equivalent ...
- 36.9k
2
votes
Accepted
Reassembling reversed ASM
SYNONYMS for Instruction ( PUSH ALL DOUBLE WORDS / longs)
pushad intel (masm , yasm , nasm , tasm)
pushal at&t with ( gas )
sqrtps = square root of single precision floating point
if ...
- 16.7k
2
votes
Accepted
Inversion of input parameters in ASM
Calling Conventions:
You may be referring to calling conventions and order of parameters being pushed. If so, here is an answer addressing as such. You can read more about calling conventions in ...
- 2,254
2
votes
Accepted
How to Make .text Section in Assembly Writeable for Win7-64 EXE
I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that.
link /SUBSYSTEM:...
- 4,952
2
votes
Working Linux assembly XOR Encoder/Decoder Failing on Windows
I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
- 36.9k
2
votes
Accepted
Debugging EXE File in Windbg and How to set Breakpoints in Assembly
It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
- 36.9k
1
vote
Injecting shellcode in ELF binary
As @goodies said in the comment what is happening here is that you are destroying some register values and thus causing a crash.
Extend your payload with pusha/popa like this
_start:
pusha
jmp ...
- 4,952
Only top scored, non community-wiki answers of a minimum length are eligible