I am learning how to use Ghidra Tool and I have a question of how to interpret one function. This is the simplified version:
Take this scenario: the location [RBP – 0x40]
, of the stack, has this value: 0xFFFF7710
(indeed this value is an address of another element in the stack... but for the question, this is irrelevant).
Now we store the address of that value in a register:
LEA RAX, [RBP – 0x40]
And finally, we execute these two instructions:
MOV EDX, 0xFFFF5520
MOV [RAX], DL
The final content in the stack [RBP – 0x40]
is 0xFFFF7720
, 0x00000020
or 0xFFFFFF20
?
Is overwritten all the content of the stack [RBP – 0x40]
via the last MOV
operation or only the last byte ?
Thanks.
The result is 0xFFFF7720
. Storing a byte to memory does not affect the other bytes of that word. (You could test it...)
User contributions licensed under CC BY-SA 3.0