Question

I’m trying to understand a little code:

jg 0x00000047
dec esp
inc esi
add [ecx],eax

What is the value of eax? These are the four first sentences of the program and i don’t know if there is a default value or if the previous sentences add something to eax.

My OS is Linux and the executable is compiled by gcc4.3 from a C source code (gcc file.c exec)

Answer 1

Some instructions implicitly update the registers, even if the destinations aren’t listed explicitly in the code. Some examples:

• cpuid returns values in eax, ebx, ecx and edx
• loop decrements ecx
• rep string instructions change ecx, edi and esi
• rdmsr changes eax and edx
• mul and div change eax and edx

And there are many other examples.

You can’t assume just by seeing that eax isn’t listed in the code that it’s not changed.

Even assuming you know which registers are affected by which instructions, the only times you have any guarantee for a value are:

• after an instruction that you know updates it
• immediately after hardware reset

At any other time, you can never make assumptions on the values.