• Welcome to Valhalla Legends Archive.
 

Discussions on The C/C++ Reversing Reference Thread

Started by Skywing, May 17, 2004, 10:28 PM

Previous topic - Next topic

Skywing

Quote from: TheMinistered on May 16, 2004, 08:21 PM
In C++, and many other languages, the compiler will generate the following code to access an item in an array:


mov eax, [arraybase+index*arraytypesize]


arraybase is the pointer to the base of the array, index is the item in the array you are trying to retreive, and arraytypesize is the size of the type the array is declared as.

Note that it would probably be a lea there, not a mov.  It's also not uncommon to see several leas if you are dealing with an array of structures.

Maddox

Quote from: Skywing on May 17, 2004, 10:28 PM
Quote from: TheMinistered on May 16, 2004, 08:21 PM
In C++, and many other languages, the compiler will generate the following code to access an item in an array:


mov eax, [arraybase+index*arraytypesize]


arraybase is the pointer to the base of the array, index is the item in the array you are trying to retreive, and arraytypesize is the size of the type the array is declared as.

Note that it would probably be a lea there, not a mov.  It's also not uncommon to see several leas if you are dealing with an array of structures.

Why would it be lea? It would depend on what the code is doing. It's not uncommon to see mov ecx, [array+index*size].
asdf.

Adron

Quote from: iago on May 16, 2004, 09:19 PM
For some arithmatic:

This C code:
int edx = 3;
edx = edx * 2 + 5;


will probably look like this:
mov edx, 3
lea edx, [5 + edx*2]


lea's can be used for arithmatic.

Note that that particular C-code probably would be optimized to assign a constant to edx ;)

iago

Quote from: Adron on May 19, 2004, 05:18 AM
Quote from: iago on May 16, 2004, 09:19 PM
For some arithmatic:

This C code:
int edx = 3;
edx = edx * 2 + 5;


will probably look like this:
mov edx, 3
lea edx, [5 + edx*2]


lea's can be used for arithmatic.

Note that that particular C-code probably would be optimized to assign a constant to edx ;)

Yes, but that would defeat the example :P
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*