How to find the offset of the mov function in assembly?

Question

I don't know how to find the original memory address altered by this code.

mov [esi+10],eax
movzx eax,byte ptr [ebp+18]

The new address obtained is the 20847BB0.

eax: 003F6C39 esi: 20847BA0 ebp: 010FF1B8

What is the previous address? Please with explanation.

The only store is to the 4 bytes at `esi+10`, and you have the ESI value. — Peter Cordes, Oct 19 '19 at 07:01

score 0 · Accepted Answer · answered Apr 17 '20 at 01:48

mov [esi+10],eax

let's look at

esi+10

We know esi is 20847BA0, if you add 0x10 to it, you get 20847BB0 which is your "new address"

movzx eax,byte ptr [ebp+18]

ebp and esp define your local stack. ebp+18 is a local stack variable

There is no other information provided, so that's all I can tell you

1 Answers1