0

Assuming stack as follows where the address of the string /bin/sh is 0x11: enter image description here

after movl %esi, 0x8(%esi) I think the value loaded form memory address %esi will be moved to 0x8(%esi) (that's the definition of movl). So string /bin/sh will be put at address 0x8(%esi). But the result is 11 is put at that address. In my opinion, if we want to put 11 at that address, we should use leal instruction because leal makes no dereference (just an address not the value).

Jester
  • 56,577
  • 4
  • 81
  • 125
HuangJie
  • 1,488
  • 1
  • 16
  • 33

1 Answers1

1

movl %esi, 0x8(%esi) is a register to memory move. The first operand is a register, it does not reference memory.

On the other hand, leal %esi, 0x8(%esi) doesn't even exist, since you can't take the address of a register, and also lea can't write to memory.

If you want to copy memory you normally need to go through a register, such as:

movl (%esi), %eax
movl %eax, 0x8(%esi)
Jester
  • 56,577
  • 4
  • 81
  • 125