Joined: 17 Feb 2008 Posts: 524 Location: Inside the Intel CET shadow stack
Posted: Sun Jun 01, 2014 12:16 pm Post subject:
LEA means "load effective address". Think of it like a mov, except that it doesn't actually move anything.
For example, "mov eax, [ebx+ecx*4]" will multiply ecx by 4, add it to ebx, then read the memory at that address and put it in eax. Conversely, "lea eax, [ebx+ecx*4]" does the same calculation, but instead of reading the memory it just puts the address into eax instead. This is a useful arithmetic instruction because you can lump multiple calculations into one instruction. It's really useful if you want to compute a pointer at a dynamic offset.
INT 3 means "interrupt 3". It causes a trap signal (step exception) to be raised, which a debugger can then catch. It's used for software breakpoints.
CMP and TEST are both comparisons. CMP does a subtraction of the two operands, and sets flags based on the result. This is useful for doing numeric comparisons, e.g. less than, equal, greater than. TEST uses bitwise AND instead of a subtraction, which is useful for checking flags. For example, if you've got a flag of 0x1000 and you want to check if a particular register has that flag set, "test reg, 0x1000" will set the zero flag if the register does not have that flag set. From there you can use jnz or jz to do conditional jumps based on that. _________________
It's not fun unless every exploit mitigation is enabled.
Please do not reply to my posts with LLM-generated slop; I consider it to be an insult to my time.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum