Welcome back.
In this lesson, we are going to take a look at memory arrays and how to implement them in assembly
inside x64dbg.
Assuming you wanted to store a sequence of numbers in memory.
For example, the numbers 11, 22, 33, 44, 55, and you also want to retrieve them sequentially.
How would you store them in memory?
One way to do it is to store them sequentially like this.
You open your template tool in x64dbg.
Head over to Memory Map and look for a data segment.
Right-click on it, follow dump, and scroll down and look for an empty space.
So basically, what we want to do is to store it like this sequentially in memory.
So let's say we store the first value here at this address 403180.
So we go to 403180.
And then we store the number 11 here.
So this is a QWORD, QWORD is eight bytes.
So we store the first number here. We will put 11 there.
Now remember that this is little-endian.
So a QWORD is read from the right to the left like this.
So this number is actually
0000000000000011.
Then we want to store our second number.
It would be here at this address.
So if you hover your mouse here, you can see a pop-up showing you the address as 403188.
So you right-click there.
Right-click this and store your number there.
So this would be 22.
And then your third number will be here, 403190.
So you select all this and then right-click and binary edit.
And you put your number 33 there.
And then the next number will be here at 403198.
Right-click, binary edit, and you put the number there, 44.
And then the last number we'll put it here, 4031A0.
So we select this QWORD, right-click, binary edit.
And we keep our number, 55.
So at this point in time, we will have all our numbers in memory.
So the first number will be at this location.
403180, which will store the number 11, and then the second number will be at 403188.
Over here, it will store the number 22.
And then the third number will be 403190, which will be over here, which will store the number 33.
-
And then the fourth number will be here.
403198 stores number 44.
And the last number will be at 4031A0, stores number 55 as indicated here.
So this is a QWORD.
And then every element of the array has got an index.
If you look at the left of the table here, it has an index.
So the index zero refers to the first number, which is 11.
And incidentally, we can also call the index as the base address because it marks the base of the array.
The array starts from here.
So the array starts from the base address, and it starts with index zero.
Then index one would be here, which is the second number, index two, index three, and index four.
So index always starts from zero.
It doesn't start from one.
Remember that this is how arrays are created inside assembly,
inside x64dbg.
You can think of arrays as variables, but the variables are sequential.
They are side by side, next to each other.
Why is this important?
Because it makes it easy to loop through them.
We can use a counter and change the index from one to the other just by incrementing the counter.
So that's why the sequential nature of the array is useful.
So how do we loop through them?
We can come up with a formula to address each of the elements using this formula like this.
So the base address will refer to the start of the array.
And if we wanted to access the next element, we will just take the counter,
the index, times eight.
Now index starts off with zero, right?
So zero times eight will still refer to the first element.
If index was one, one times eight will refer to the second element.
Why the "times eight"? Why times eight?
Because the distance from one memory array to the next is a QWORD.
A QWORD from here to here is a QWORD, as you can see.
So that's why we multiply with eight.
So if you want to access the third element, the index will be two.
So X will be two, two times eight.
Then you will get this value here.
You will reach this address.
So this is the formula to use when you want to go through the array elements.
So X is your index and also a counter.
And how are you going to loop through the elements of the array?
We will see that in the next lesson.
That's all for this video.
Thank you for watching.