15

I was debugging CLR code in assembly, and got to a line

mov rax, qword ptr [ff4053c0h]

I think qword ptr [ff4053c0h] refers to a string I'm interested in, but ff4053c0h is not a valid memory location. Reading about qword ptr it seems to reference an address based on a base register (e.g. qword ptr [rsp+30h] is 30 bytes into the stack), but I can't find what it means with no base register.

lurker
  • 56,987
  • 9
  • 69
  • 103
Rattle
  • 2,393
  • 2
  • 20
  • 25
  • It's referring to the address location pointed to by `ff4053c0h` as a quad word (64 bits). Whatever 64-bit value is at that address will be loaded into `rax`. If the address isn't valid, then there's a problem. Are you sure it's not valid? – lurker Jul 03 '15 at 17:31

3 Answers3

12

When no base register is provided, it means data segment (http://www.osdata.com/system/physical/memory.htm). In your code, mov rax, qword ptr [ff4053c0h] means "take 8 bytes from data segment offset FF4053C0h and put them in RAX".

As you are pointing correctly, the presence of a base register like rsp clearly indicates stack segment. In your case, no base register means data segment.

Now, about the big number "FF4053C0h", which is "4 282 405 824", it's perfectly possible to have 4Gb of addressable memory (http://wiki.osdev.org/Protected_Mode), which confirms that your line of code might be valid and it's accessing offset FF4053C0h in a huge data segment (http://www.ece.unm.edu/~jimp/310/slides/micro_arch2.html).

Another source = Assembly: Using the Data Segment Register (DS) .

Community
  • 1
  • 1
Jose Manuel Abarca Rodríguez
  • 10,206
  • 3
  • 31
  • 38
  • I said the address was invalid because when I look for it in the memory window in visual studio debugger it showed unmapped memory (?? Instead of contents). The memory window should show data segment by default, so I'm not sure what I'm missing, I'll check again later. – Rattle Jul 03 '15 at 20:14
  • @Rattle, the operating system might protect the memory from been accessed by other processes, so these processes can not see protected memory. – Jose Manuel Abarca Rodríguez Jul 03 '15 at 20:29
9

Without complicating the things for no good reason:

It means that a 64 bit value is read from the address 0ff4053c0h into the register RAX.

The address must be valid, check again.
The QWORD PTR is just a size specifier (redundant here, but it improves readability), it is not related with having a base register.

If you really are interested into the various addressing modes the CPU have, you can read the Intel Manuals (Google that).

2

You are moving a 64bit value from memory into the rax register. The value is read from the address ff4053c0h. qword ptr is a hint for the assembler to create a move op-code (machine code) using a 64bit constant address. The value that is provided is a 32bit value (8 hex-digits => 8 times a hex-digit/letter => 8 * 4bits => 32bit).

There are move op-codes that support 32bit operations but (most likely check the specs for the CPU/Mode) not for loading memory into a 64bit register. So qword is needed to ensure the assembler you really want to express a 64bit address.

For your comment about the address pointing to undefined memory (see comments for acepted answer), understand that nowadays every process has a virtual memory table assigned. Virtual memory basically maps a logical address to an address in real memory. It prevents processes from seeing and altering memory that does not belong to the process, providing a great deal of stability to a running system.

Having two processes both sharing a portion of memory, it is possible that each individual process see the very same physical memory at different logical addresses. The operating system decides what the virtual memory of each process looks like.

The mapping is provided on a per page level (e.g. page=4KB) and the processor does the actual mapping internally.

This concept is very true for mapping files to memory and sharing the memory between different processes. This way you can map a 2GB file into memory and have 10 processes concurrently working with the very same mapped file while only (at most) 2GB actual memory is consumed. It is the way file io-caching is mostly done on the OS-level.

Martin Kersten
  • 5,127
  • 8
  • 46
  • 77