0

I am learning how to use Ghidra Tool and I have a question of how to interpret one function. This is the simplified version:

Take this scenario: the location [RBP – 0x40], of the stack, has this value: 0xFFFF7710 (indeed this value is an address of another element in the stack... but for the question, this is irrelevant).

Now we store the address of that value in a register:

LEA RAX, [RBP – 0x40]

And finally, we execute these two instructions:

MOV EDX, 0xFFFF5520
MOV [RAX], DL

The final content in the stack [RBP – 0x40] is 0xFFFF7720, 0x00000020 or 0xFFFFFF20 ?

Is overwritten all the content of the stack [RBP – 0x40] via the last MOV operation or only the last byte ?

Thanks.

Nate Eldredge
  • 48,811
  • 6
  • 54
  • 82
Federico Jensen
  • 3
  • 1
  • 2
  • Based on the register names, you seem to be in 64-bit mode, in which case your `0xFFFF5520` is not an address but only half of one. – Nate Eldredge Jan 02 '21 at 17:14

1 Answers1

1

The result is 0xFFFF7720. Storing a byte to memory does not affect the other bytes of that word. (You could test it...)

Nate Eldredge
  • 48,811
  • 6
  • 54
  • 82