Tag Archives: assembly

LEA instruction

The lea instruction places the address specified by its second operand into the register specified by its first operand. Note, the contents ofthe memory location are not loaded, only the effective address is computed and placed into the register. This is useful for obtaining a pointer into a memory region. source: http://www.cs.virginia.edu/~evans/cs216/guides/x86.html

software interrupt –

WinDbg shows “int” Instruction ntdll!DbgBreakPoint: 7c901230 cc int 3 7c901231 c3 ret 7c901232 8bff mov edi,edi ntdll!DbgUserBreakPoint: 7c901234 90 nop 7c901235 90 nop 7c901236 90 nop 7c901237 90 nop ntdll!DbgBreakPointWithStatus: 7c901238 90 nop ntdll!DbgUserBreakPoint: 7c901239 cc int 3 7c90123a c3 ret 7c90123b 90 nop 7c90123c 8bff mov edi,edi 7c901230 cc int 3 Process Involved WinRAR …

Continue reading “software interrupt –”

RET instruction :)

WinDbg shows RET Instruction 7c901042 c20400 ret 4 7c901045 52 push edx 7c901046 e8447f0100 call ntdll!RtlpWaitForCriticalSection (7c918f8f) 7c90104b 648b0d18000000 mov ecx,dword ptr fs:[18h] 7c901052 8b542404 mov edx,dword ptr [esp+4] 7c901056 ebc4 jmp ntdll!RtlEnterCriticalSection+0x17 (7c90101c) 7c901058 8da42400000000 lea esp,[esp] 7c90105f 8d9b00000000 lea ebx,[ebx] 7c901065 8b4124 mov eax,dword ptr [ecx+24h] 7c901068 39420c cmp dword ptr [edx+0Ch],eax 7c90106b …

Continue reading “RET instruction :)”