Suppose I have the following snippet:
push  ebp                       (1)
mov   ebp,esp                   (2)
mov   eax,0xaf                  (3)
xor   al,al                     (4)
mov   ah,BYTE PTR [ebp+0x9]     (5)
And I call this with the following arguments: 0xdeadbeef, 0xdeefbeab, 0xf00b1den. I'm basically unsure of BYTE PTR is. My assumption:
at (3) the eax stack looks as follows (grouped in 8 for readability):
00000000 00000000 00000000 10101111
at (4):
00000000 00000000 00000000 00000000
at (5):
Is then 0xb1 (the 9th byte in my argument taken as an array) moved in?
00000000 00000000 10110001 00000000
User contributions licensed under CC BY-SA 3.0