Question

Hey guys. I know the answer, but can you help me with understanding a step by step process of how to get the answer! #1

.data myPtrCheck BYTE 12h, 34h, 56h, 78h, 90h, ABh, CDh, EFh

.code

...

mov eax, DWORD PTR [myPtrCheck+2] EAX contains what value, in hexadecimal? answer is AB907856h

#2 Suppose that you are given the following partial data segment:

.data myPtrCheck BYTE 12h, 34h, 56h, 78h, 90h, ABh, CDh, EFh

.code

... mov eax, DWORD PTR myPtrCheck EAX contains what value, in hexadecimal? answer = 7863412h

Answer 1

first, you need to know about the little endian structure of memory.

if the memory is of little endian structure and suppose you want to store a word data like 1234h, where h is for hexadecimal. Now you know that memory is divided into byte and the word contain 2 bytes. So after storing the 1234h into memory, the memory will look like:

...............................

34

12

..............................

remember that 34h is the LSB byte of the word and 12h is the is the MSB byte of the word. Hence in little endian memory. The system store the bytes in memory from LSB byte towards MSB byte.

Similarly for a double word data eg. 12345678h, storing this will make the memory look like:

...............

78

56

34

12

..................

Also remember that, while reading the memory, the computer treat the first byte as LSB byte, second byte of memory as one byte left from LSB, third byte as 2 byte left from LSB and so on.....

So, in your case,

the memory is:

...............
12
34
56
78
90
AB
CD
EF
.............

Now myPtrCheck+2 is pointing to memory location where the content is 56. So it the first byte of the double word we will read.

read the first byte as LSB : 56

read second byte as left to LSB: 7856

read third byte as left to second 2nd left to LSB: 907856

read fourth byte as MSB : AB907856h

I hope you understand the concept of little endian memory. (storing the content of register or loading the content to register begins with LSB ).

Now it is easy to get the result for next one:

...............
12
34
56
78
90
AB
CD
EF
.............

mov eax, DWORD PTR myPtrCheck

myPtrCheck points to memory location at 12. begin from this byte.

12

3412

563412

78563412h