What does MOV EAX, DWORD PTR DS:[ESI] mean and what does it do?

AssemblyX86

Assembly Problem Overview


Alright so I have this line in my assembly

MOV EAX, DWORD PTR DS:[ESI]

where ESI is 00402050 (ascii, "123456789012")

After this instruction: EAX = 34333231

What really happened here? How is this value calculated, and why?
Where could I get some good reference on this kind of thing?

Assembly Solutions


Solution 1 - Assembly

Registers in square brackets such as [ESI] are dereferenced pointers. The instruction you quote moves the DWORD (a 32-bit/4-byte value) in memory location specified by ESI into register EAX. In your case, memory location 00402050, read as a DWORD, contains 34333231.

Written in pseudo-C:

DWORD EAX;   /* Declaring the registers as we find them in silico */
DWORD ESI;

ESI = 0x00402050;  /* Set up your initial conditions for ESI */
EAX = *((DWORD *)ESI);   /* mov EAX, DWORD PTR [ESI] */
/*  ^ ^  ^^^^^^^    */
/*  | |     |       */
/*  | |     +-----------  From "DWORD PTR" we get "DWORD *" in C.          */
/*  | |             */ 
/*  | +-----------------  The C dereferencing operator * replaces [].      */
/*  |               */ 
/*  +-------------------  The C assignment operator = replaces mov opcode. */ 

In your case, it is not true that 0x00402050 "equals" the string "1234567890" -- rather it points to the memory which contains that string.

The value which you obtain, 0x34333231 is comprised from the ASCII values for the digits "1234", which are the first four bytes (i.e., the first DWORD) of the string. They appear in reversed order because the Intel architecture is "little endian" in the byte representation of a DWORD in memory.

In your example at this time, the mov instruction is loading ASCII characters as if they were the four bytes of an unsigned long value, when they are actually a string of single-byte characters.

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionzetaView Question on Stackoverflow
Solution 1 - AssemblyHeath HunnicuttView Answer on Stackoverflow