Consider this x86 assembly code:
section .data
foo:
mov ebx, [boo]
mov [goo], ebx
goo:
mov eax, 2
mov eax, 3
ret
boo:
mov eax, 4
mov eax, 5
ret
What exactly is going on here? When I dereference [boo] and mov it to [goo] what exactly am I moving there? Just one command? The ret as well?
Follow-up questions:
eax have a value of 3 or 5 at the end?boo is the offset of the instruction mov eax, 3 inside section .data.
mov ebx, [boo] means “fetch four bytes at the offset indicated by boo inside ebx”.
Likewise, mov [goo], ebx would move the content of ebx at the offset indicated by goo.
However, code is often read-only, so it wouldn't be surprising to see the code just crashing.
Here is how the instructions at boo are encoded:
boo:
b8 03 00 00 00 mov eax,0x3
c3 ret
So what you get in ebx is actually 4/5 of the mov eax, 3 instruction.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With