3
votes

I'm "debugging" a piece of x86 code - the preface being fine a series of 5 numbers from the code that "unlock" it, it's jumping around a lot in memory + math with the numbers that hold it.

I've traced what I need to input before the first "jump", it's:

cmp    %eax,0x80498d4(,%ebx,4)

I understand that this command is cmp s, d where I am taking d-s and setting EFLAGS. But what is D 0x80498d4(, %ebx,4) in this instance? Clearly something is being done to register %ebx, but I don't know what.

1

1 Answers

4
votes

That's AT&T memory reference syntax.

AT&T's displacement(base register, offset register, scalar multiplier) syntax converts to Intel's [base register + displacement + offset register * scalar multiplier] syntax (which I think is much easier to understand).

So cmp %eax,0x80498d4(,%ebx,4) in AT&T syntax is equivalent to cmp [80498d4h + ebx*4], eax in Intel syntax.

The instruction reads in English as "compare the contents of register EAX with the contents of memory at address 0x80498d4+(EBX*4)".