assemblystackx86-64movghidra

How the stack is overwritten via deferencing MOV operation [Assembler x86]?

I am learning how to use Ghidra Tool and I have a question of how to interpret one function. This is the simplified version:

Take this scenario: the location [RBP – 0x40], of the stack, has this value: 0xFFFF7710 (indeed this value is an address of another element in the stack... but for the question, this is irrelevant).

Now we store the address of that value in a register:

LEA RAX, [RBP – 0x40]

And finally, we execute these two instructions:

MOV EDX, 0xFFFF5520
MOV [RAX], DL

The final content in the stack [RBP – 0x40] is 0xFFFF7720, 0x00000020 or 0xFFFFFF20 ?

Is overwritten all the content of the stack [RBP – 0x40] via the last MOV operation or only the last byte ?

Thanks.

Solution

  • The result is 0xFFFF7720. Storing a byte to memory does not affect the other bytes of that word. (You could test it...)