Home/ Questions/Q 788613
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T21:23:42+00:00

Given the following x86 assembly instructions: mov esi, offset off_A cmp esi, offset off_B

  • 0

Given the following x86 assembly instructions:

mov     esi, offset off_A
cmp     esi, offset off_B

how would I get the offsets (the second operand) at runtime ? This is the scenario: A program (injected into the process at runtime) replaces the offsets with a few of its own, resulting in:

mov     esi, offset off_X
cmp     esi, offset off_Y

This program allows plugins to be written and loaded through it but doesn’t expose the replacement addresses. So, given the addresses at which the above instructions exist, how do I find offsets X and Y ?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I don’t quite understand what this is for, but…

    mov esi, ... is encoded as BE followed by the dword operand. If you’ve got the address of the mov instruction you can simply skip one byte ahead and see the address operand, off_A

    cmp esi, ... is encoded as 81 FE followed by a dword operand, so here you can skip two bytes to see the operand.

    • 0