Mastering Reverse Engineering
上QQ阅读APP看书,第一时间看更新

Copying data

The MOV  instruction is used to move data. With this, data is moved either to or from a register or a memory address.

mov eax, 0xaabbccdd  places the 0xaabbccdd value in the eax register.

mov eax, edx places the data value from theedx register to the eax register.

Let's take the following memory entries as an example:

Address   Bytes
00000060: 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F
00000070: 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F
00000080: 80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D 8E 8F
00000090: 90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E 9F

Reading data may require using directives to help the assembler. We use byte ptr, word ptr, or dword ptr:

; the following lines reads from memory
mov al, byte ptr [00000071] ; al = 71h
mov cx, word ptr [00000071] ; cx = 7271h
mov edx, dword ptr [00000071] ; edx = 74737271h

; the following lines writes to memory
mov eax, 011223344h
mov byte ptr [00000080], al ; writes the value in al to address 00000080
mov word ptr [00000081], ax ; writes the value in ax to address 00000081
mov dword ptr [00000083], eax ; writes the value in eax to address 00000083

The memory will look like this afterward:

00000060: 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 
00000070: 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F
00000080: 44 44 33 44 33 22 11 87 88 89 8A 8B 8C 8D 8E 8F
00000090: 90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E 9F