5

hello I am trying to pick up assembly on intel32,

my full question is, what does this mean?

mov dword ptr [esp+18h], 0AH

I especially do not get the part at [esp+18h]

4
  • Did you consider looking up the documentation?
    – user207421
    May 9, 2014 at 8:18
  • This question appears to be off-topic because the OP has made zero research effort.
    – user207421
    May 9, 2014 at 8:19
  • @I found my answer from reading through the documentation at intel.com/content/www/us/en/processors/… I doubt it is something most people would be interested to go through
    – laycat
    May 9, 2014 at 9:02
  • 1
    The question is whether you were prepared to go through it. Glad to see you finally did. It only means one thing: double word.
    – user207421
    May 9, 2014 at 9:52

3 Answers 3

11

Brackets in [ESP+18h] mean that the destination of the MOV is memory location at ESP+18h. As an example, if ESP has value 10000000h, then your destination is memory location 10000018h.

DWORD defines 'size' of the memory location used for move operation. In you example, you'd be moving 0000000Ah (4 bytes) into memory location ESP+18h. As 0Ah is immediate value its size cannot be determined without using DWORD, WORD, BYTE or other similar qualifier.

Intel convention is to define the 'size' of the destination memory location instead of the immediate itself (e.g. MOV DWORD PTR [ESP+18h], 0Ah vs MOV [ESP+18h], dword 0Ah).

7

It means store the doubleword (4 bytes on x86) value 0AH (same as 0000000AH) in memory at address esp+18h. For example, if esp contains the value 4 and the memory contents look like:

Address      Contents
-----------------------------------------------------
0000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0010: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F

The after mov dword ptr [esp+18h], 0AH you would have:

Address      Contents
-----------------------------------------------------
0000: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0010: 10 11 12 13 14 15 16 17 18 19 1A 1B 0A 00 00 00

Just writing mov [esp+18h], 0AH would be ambigous since the size of the immediate (0AH) can't be deduced from the instruction. Hence dword ptr is added to tell the assembler that the memory operand is a dword and that the immediate therefore also should be a dword.

2

This is likely referring to a memory location that is being used as a variable location. The [esp+18h] is a reference like a pointer (*) in C. ESP stands for the Extended Stack Pointer. The ESP register contains an address to a memory table where values are stored. You take the value is ESP and add 18h offset to find the final location of the memory address where you want to store the value 0AH.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.