Consider this x86 assembly code:
section .data
foo:
mov ebx, [boo]
mov [goo], ebx
goo:
mov eax, 2
mov eax, 3
ret
boo:
mov eax, 4
mov eax, 5
ret
What exactly is going on here? When I dereference [boo]
and mov
it to [goo]
what exactly am I moving there? Just one command? The ret
as well?
Follow-up questions:
eax
have a value of 3 or 5 at the end?boo
is the offset of the instruction mov eax, 3
inside section .data
.
mov ebx, [boo]
means “fetch four bytes at the offset indicated by boo
inside ebx
”.
Likewise, mov [goo], ebx
would move the content of ebx at the offset indicated by goo
.
However, code is often read-only, so it wouldn't be surprising to see the code just crashing.
Here is how the instructions at boo
are encoded:
boo:
b8 03 00 00 00 mov eax,0x3
c3 ret
So what you get in ebx
is actually 4/5 of the mov eax, 3
instruction.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With