banner
lca

lca

真正的不自由,是在自己的心中设下牢笼。

"Learning Notes on IDA Reverse Engineering from Scratch" - Chapter 5 (lea Instruction)

image

LEA Instruction#

LEA stands for "LOAD EFFECTIVE ADDRESS: 'LEA A, B'" instruction transfers the address of B to A.
This instruction does not retrieve the content stored in B, it only passes the address or the result of the next operand (plus square brackets). This method is commonly used to obtain the address of variable parameters.

image

Function Parameters and Local Variables#

Functions identified by IDA generally require passing parameters before calling, most of which are done through the PUSH instruction (only for 32-bit).

image

Function Parameters

image

Passing Parameters

Although the LEA instruction uses square brackets, it only calculates the expression within the brackets and passes the address without reading its content.

Other Uses of LEA#

LEA can also be used to pass the result of the expression within the brackets to the destination register without reading the content stored at the result address. For example, the instruction "LEA EAX, [4+5]" passes the result of the calculation, 9, to EAX, without passing the content stored at address 0x9 to EAX, as the "MOV EAX, [4+5]" instruction does.

LEA obtains the address of a variable, while MOV obtains the value stored at the variable's address (except for OFFSET).

Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.