Question

What function have short and large in this code portion? large is same as long dword? 

mov eax, ebx
cmp [ebp+var_1], 0
jz  short loc_413123
call sub_40341C
pop large dword ptr fs:0
add esp, 0Ch
Was it helpful?

Solution

short

jz short loc_413123 merely means that the offset (i.e. distance) for this jump is so small that it fits in a single byte, so this jump has been compiled to two simple bytes:

0x74 [1-byte-offset]

Had the distance been larger, the compiler would have had to encode the jump differently, which would take up more memory:

0x0f 0x84 [4-byte-offset]

With short, IDA Pro is simply telling you what kind of encoding this jump is using.

large

pop large dword ptr fs:0 is IDA's way of bringing to your attention that fs:0 is a far pointer: a regular offset (0) but with a segment selector (fs). I.e. large has nothing to do with the width of the data (dword), but the address (segment+offset). However, large doesn't really add any new information, that line simply means pop dword ptr [fs] and that might be the disassembly you would get from a different disassembler.

You can safely ignore both these keywords when you read the disassembly and they are certainly not necessary when writing your own assembly code.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top