Question

hello I am trying to pick up assembly on intel32,

my full question is, what does this mean?

mov dword ptr [esp+18h], 0AH

I especially do not get the part at [esp+18h]

Was it helpful?

Solution

Brackets in [ESP+18h] mean that the destination of the MOV is memory location at ESP+18h. As an example, if ESP has value 10000000h, then your destination is memory location 10000018h.

DWORD defines 'size' of the memory location used for move operation. In you example, you'd be moving 0000000Ah (4 bytes) into memory location ESP+18h. As 0Ah is immediate value its size cannot be determined without using DWORD, WORD, BYTE or other similar qualifier.

Intel convention is to define the 'size' of the destination memory location instead of the immediate itself (e.g. MOV DWORD PTR [ESP+18h], 0Ah vs MOV [ESP+18h], dword 0Ah).

OTHER TIPS

It means store the doubleword (4 bytes on x86) value 0AH (same as 0000000AH) in memory at address esp+18h. For example, if esp contains the value 4 and the memory contents look like:

Address      Contents
-----------------------------------------------------
0000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0010: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F

The after mov dword ptr [esp+18h], 0AH you would have:

Address      Contents
-----------------------------------------------------
0000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0010: 10 11 12 13 14 15 16 17 18 19 1A 1B 0A 00 00 00

Just writing mov [esp+18h], 0AH would be ambigous since the size of the immediate (0AH) can't be deduced from the instruction. Hence dword ptr is added to tell the assembler that the memory operand is a dword and that the immediate therefore also should be a dword.

This is likely referring to a memory location that is being used as a variable location. The [esp+18h] is a reference like a pointer (*) in C. ESP stands for the Extended Stack Pointer. The ESP register contains an address to a memory table where values are stored. You take the value is ESP and add 18h offset to find the final location of the memory address where you want to store the value 0AH.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top