mov BX to EAX ~ the newbiest question

Index > Main > mov BX to EAX ~ the newbiest question

Goto page 1, 2, 3, 4, 5, 6 Next

Author

Thread

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 17:45

Code:

mov eax, bx ; size do not match!

How can I move value from BX to EAX?

_________________
Sorry if bad english.

31 Dec 2009, 17:45

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 31 Dec 2009, 17:52

depends, if you want to sign-extend (negative bx makes negative eax) or zero-extend (upper 2 bytes are always 0).

Code:

movsx eax, bx ; sign-extend (i.e if bx's sign bit is 1, then upper 2 bytes of eax will be 1s)
movzx eax, bx ; zero-extend, upper 2 bytes always 0

31 Dec 2009, 17:52

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 17:57

i got it. Thanks.

Another newbiest question:
This function returns in lo-order Width and in hi-order Height, and the value is in EAX:

Code:

invoke  SendMessage,[hToolBar],TB_GETBUTTONSIZE,0,0

how do I get both values?

Ok, AX = lo-word.
but and hi-order word?

31 Dec 2009, 17:57

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 31 Dec 2009, 18:16

just shift eax right by 16 bits Question

this would destroy the old 'ax' though, so you probably should save it to another register.

or you could "rotate" right by 16 bits (ror eax, 16) and then ax would become the hi-word and the upper 2 bytes would be the old 'ax'.

_________________
Previously known as The_Grey_Beast

31 Dec 2009, 18:16

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 19:04

1. is shl eax, 16 = rol eax, 16 ?

2. is shl eax, 1 = value/2 ? (I did see that in some place...)

31 Dec 2009, 19:04

MHajduk

Joined: 30 Mar 2006
Posts: 6115
Location: Poland

MHajduk 31 Dec 2009, 19:10

Teehee wrote:

1. is shl eax, 16 = rol eax, 16 ?

No.

Teehee wrote:

2. is shl eax, 1 = value/2 ? (I did see that in some place...)

Code:

shl eax, 1 ; eax := 2*eax
shr eax, 1 ; eax := eax / 2

31 Dec 2009, 19:10

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 19:36

Quote:

No.

So what!?

whats the difference?

Code:

shl eax, 1 ; eax := 2*eax 
shr eax, 1 ; eax := eax / 2

Good to know! Smile

31 Dec 2009, 19:36

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 19:45

I have some difficult to understand the [x] thing.

ex:

Code:

mov ecx, edx    ; move the value of edx?
mov ecx, [edx]  ; move the address of edx?
mov eax, [var1] ; move the address of var1?
mov ebx, [var2]
cmp [ebx], eax  ; whats the CMP line mean? cmp address with value?

Last edited by Teehee on 31 Dec 2009, 19:58; edited 1 time in total

31 Dec 2009, 19:45

MHajduk

Joined: 30 Mar 2006
Posts: 6115
Location: Poland

MHajduk 31 Dec 2009, 19:50

Teehee wrote:

So what!? whats the difference?

shl shifts left bits of the register/memory cell, filling lowest bits with zeros. rol rotates bits of operand left (the highest bits values are copied into the proper lowest ones). Do you see the difference now?

I recommend to read FASM manual - there you can find answers for the most of your questions. Wink

31 Dec 2009, 19:50

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 19:53

yeah i do

i did read the fasm manual but somethings just do not enter in my head easilly. heh

for example: why some functions you need to do that:
1.

Code:

 invoke somefunc,my_var

and in anothers, that:
2.

Code:

 invoke somefunc,[my_var]

if at 2. i pass memory, what I pass at 1.? i think in my mind that my_var (with [] or not) is always memory.

edit:
real example:

Code:

invoke BeginPaint,[hwnd],paintstruct
                    ^within   ^without

31 Dec 2009, 19:53

Picnic

Joined: 05 May 2007
Posts: 1389
Location: Piraeus, Greece

Picnic 31 Dec 2009, 20:55

Hi Teehee,

[hwnd] is the value stored inside variable whose address declared in your data section like hwnd dd ? or hwnd: dd ?
paintstruct points to the address of the structure.

Teehee wrote:

This function returns in lo-order Width and in hi-order Height, and the value is in EAX:
Code:
invoke  SendMessage,[hToolBar],TB_GETBUTTONSIZE,0,0    
how do I get both values?

Ok, AX = lo-word.
but and hi-order word?

Here are some methods, snippets found inside forum.

Code:

;LOWORD HIWORD method (value on eax)
movzx ecx, ax   ;LOWORD      
shr eax, 16
mov edx, eax     ;HIWORD
    
; LOWORD HIWORD method
mov   eax, [lparam]
movzx edx, ax
shr   eax, 16
mov   [g_width], edx  ; LOWORD(lParam)
mov   [g_height], eax ; HIWORD(lParam)

;LOWORD HIWORD method
mov ax, word [somewhere]     ;LOWORD
mov bx, word [somewhere+2]  ;HIWORD

31 Dec 2009, 20:55

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 31 Dec 2009, 22:44

Thanks, Picnic.

Another question:
Why when I have a global variable, like:

Code:

string rb 10

I can do that:

Code:

mov esi, string

But when I have a local variable, like:

Code:

locals
    string rb 10
endl

I need to load efective address:

Code:

lea esi,[string]

?

In this case it does not accept mov esi,string, like global.

31 Dec 2009, 22:44

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20303
Location: In your JS exploiting you and your system

revolution 31 Dec 2009, 22:52

Inside 'locals' it is ebp based.

'lea esi,[string]' as actually assembled as 'lea esi,[ebp+offset]'. So when trying to do 'mov esi,string' you are actually trying to assemble 'mov esi,ebp+offset'

31 Dec 2009, 22:52

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 01 Jan 2010, 09:43

ohh.. i got it.

Questions:
1. When I alloc local space like sub esp,8 i need always to set ebp = esp (mov ebp,esp)? If yes, why?
2. Also when I do a sub esp,8 i need always to add esp,8 in the end?

Here two real examples i'm doing:

Code:

sub    esp, 2*4
mov    eax, esp
mov    dword [esp+0*4], sizeof.INITCOMMONCONTROLSEX
mov    dword [esp+1*4], ICC_BAR_CLASSES+ICC_COOL_CLASSES
invoke InitCommonControlsEx,esp
add    esp, 2*4

Code:

sub     esp,4*4        ; RECT struct  [4 * dd (left,top,right,bottom)] ; Allocate space
invoke  GetWindowRect,[hMainWnd],esp
mov     ebx,[esp+3*4]   ; 3 = rect.bottom
invoke  GetClientRect,[hReBar],esp
sub     ebx,[esp+3*4]   ; MainWndHeight - ReBarHeight -> EBX = TreeViewHeight
mov     eax,[esp+3*4]   ; EAX = y
invoke  MoveWindow,[hTreeView],0,eax,150,ebx,TRUE
add     esp,4*4         ; Free allocated space

(i'm not using ebp=esp, bc yet i don't know if it is needed. Idem to add esp,4*4)

01 Jan 2010, 09:43

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20303
Location: In your JS exploiting you and your system

revolution 01 Jan 2010, 11:35

Teehee: You can access esp directly like that but beware when you want to push an esp based parameter that is not the last:

Code:

invoke SomeFunction,[esp],eax,... ;<--- dangerous, esp parameter is not last
invoke SomeFunction,ebx,eax,[esp] ;<--- okay because esp is the last parameter

It can be done but you have to adjust the esp offset by +4 for each parameter that comes after the [esp] parameter.

01 Jan 2010, 11:35

Rahsennor

Joined: 07 Jul 2007
Posts: 61

Rahsennor 01 Jan 2010, 11:44

Teehee wrote:

1. When I alloc local space like sub esp,8 i need always to set ebp = esp (mov ebp,esp)? If yes, why?

You can just use esp if you want. But then every push/pop will change esp, and so the offset of variables will change, as revolution said. If you copy esp to ebp (or any other register), you have a fixed offset (and can tell fasm, using 'label x at ebp+123' or 'virtual at ebp+123').

Teehee wrote:

2. Also when I do a sub esp,8 i need always to add esp,8 in the end?

Yes. Otherwise, when you try to return, the CPU will read something other than the return address and go who-knows-where.

01 Jan 2010, 11:44

sleepsleep

Joined: 05 Oct 2006
Posts: 12742
Location: ˛　　　　　　　　　　　　　　　　　　　　　　　　　　　　　⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 0010456

sleepsleep 01 Jan 2010, 12:01

Quote:

How can I move value from BX to EAX?

xor eax eax
mov ax,bx

also perform the same trick

hi teehee
the [x] is like value of the x.

the concept is not really hard to grabs.
since address is linear.
0000 to maybe 9999
assume each space is a DWORD. (4 bytes)

so let say i want to put value 4000 into address 0000.
so,
mov eax, 0000
mov [eax], 4000
will make 4000 into address 0000
if let say later i want to take the value of address 0000 into register edx
i can do
mov eax,0000
mov edx,[eax]

see... it not so hard Smile

01 Jan 2010, 12:01

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 01 Jan 2010, 12:56

Thanks revolution and Rahsennor.

@sleepsleep:
In this case:

Code:

var1: 0000 address  ; just example
         7 value
var2: 00FF address
         5 value
mov eax, [var1] ; mov value of var1 (7) to eax ; eax = 7 ?
mov ebx, [var2] ; mov value of var2 (5) to ebx ; ebx = 5 ?
cmp [ebx], eax  ; cmp address (0005) with value of eax (7)?

real example from this topic:

Code:

.wm_notify: 
                mov     ebx, [lparam] 
                mov     eax, [hToolBar] 
                cmp     [ebx], eax 
                jne    @f 
                invoke  MessageBox,NULL,_error,NULL,MB_ICONERROR+MB_OK 
            @@: jmp    .finish0

assuming:
lparam   = 0000 address and 123 value
hToolBar = 000A address and 125 value
mov     ebx, [lparam]   ; ebx = 123
mov     eax, [hToolBar] ; eax = 125
cmp     [ebx], eax      ; 0123 address == 125 value? why not just cmp ebx,eax?

Thats make no sense to me. But if I do cmp ebx, eax it get wrong.

01 Jan 2010, 12:56

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20303
Location: In your JS exploiting you and your system

revolution 01 Jan 2010, 13:02

WM_NOTIFY
idCtrl = (int) wParam;
pnmh = (LPNMHDR) lParam;

pnmh:
Pointer to an NMHDR structure that contains the notification code and additional information. For some notification messages, this parameter points to a larger structure that has the NMHDR structure as its first member.

ebx is a pointer to the pnmh structure.

typedef struct tagNMHDR {
HWND hwndFrom;
UINT idFrom;
UINT code;
} NMHDR;

So we compare [NMHDR.hwndFrom] = [hToolBar]

[NMHDR.hwndFrom] = [ebx+0]
[hToolBar] = eax

01 Jan 2010, 13:02

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 01 Jan 2010, 13:07

Ohhhhhhhhhhhhh... *_*
Just a simple detail... lol.. thank you so much rev.

01 Jan 2010, 13:07

Goto page 1, 2, 3, 4, 5, 6 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum