Hello and welcome back.
In this lesson, we are going to learn how to use the exchange instruction.
So there are two main forms.
The first one is exchange register and register.
The second form is exchange memory and register.
So what it does is to swap values between the two registers, or to swap values between the memory and
the register.
So let's open up our x64dbg and now the template program and start keying these instructions.
We put a breakpoint here first.
Then,
now we type our instruction.
The first one is exchange XCHG - -.
Okay.
And the second one is - we will do it later.
So we put a breakpoint, we run, and then we step over until we come to this instruction.
Now we are going to put a value in - in -.
So you right-click - first and we modify the value there.
Let's say we put three in -, and then we right-click on -.
Modify the value.
And let's say we put five here.
So now we have three in - and five in -.
And now we are about to execute this instruction.
So let's step over and see what happens.
So we step over now.
And you notice now the values have swapped places.
Five has gone up to - and three has gone down to -.
Now let's take a look at the second one.
Exchange memory with -.
So now we have to put a value in memory.
So let's go to select dump one and let's go to the memory map.
Select data.
Double-click on it and let's choose a blank memory here.
Let's say this - where this memory address here.
And let's say we put 1234.
We select
all this,
and then we put 1234 binary edit.
So it will be in reverse endian, reverse format because of little-endian.
So let's see. Okay.
So now we have 1234 there in this address.
So let's copy that.
Right-click this address and copy that address.
And now we go up to this line and let's press spacebar.
Type XCHG.
And then put our memory keyword pointer, the hex prefix,
and then we paste our address that we have copied and we type -.
So now let's put some value in -.
Over in -, let's put five six seven eight, modified, and then type 5678.
All right.
So now - has got 5678,
and this address in memory has got 1234.
So it's supposed to swap places.
So let's execute this line now.
And you see one two three four has swapped into -.
And it has reversed the order here. It was 3412,
so over here it became 1234.
And here five six seven eight has gone into the memory instead,
and it has reversed the reverse order because of little-endian.
It becomes five six seven eight, but in reverse order.
So this is how we can use the exchange instruction in the x64dbg.
So that's all for this video.
Thank you for watching.