Hi there...
While learning reversing, I stumbled over the usage of the segment : offset syntax, for example
Code:
LEA EDI,DWORD PTR SS:[EBP-CC]
in Olly.
I don't worry about that -CC, which is probably an offset to a variable on the stack after a struct or something which isn't really important to me right now.
I mean, I already read stuff about segment : offset addressing, 20-bit mode etc., so why do we need something like SS:[EBP] in protected 32-bit mode?
From what I read in various tuts, "today's" segment : offset addressing is something like
segment | offset
0xFADD | 0x1337 = 0xFADD1337.
The problem I see, is that EBP is 32-bits wide, therefore I assumed that only BP is used in that operator (?), but even that doesn't make sense to me, because the higher bits of EBP would be in most cases equal to SS.
So, I'm kinda messing around with some basic assembler code because I did not get my hands on a good reference till now. I'm ashamed to ask if some of you could help me out and/or give me a good reference?