Hello and welcome back.
In this lesson, we are going to learn about LEA, LEA.
LEA stands for Load Effective Address.
In x64 assembly language, particularly on Windows PCs,
the LEA instruction stands for Load Effective Address.
Its primary purpose is to compute the address of a memory operand and store that address in a register.
Unlike other instructions that might also access memory, such as MOV, LEA does not actually access
the memory location to read or write data.
Instead, it simply computes and stores the address itself.
The LEA instruction is often used for several purposes.
First, address calculation.
It's commonly used to calculate the address of a variable or array element efficiently.
Since LEA can perform addition and multiplication in a single instruction, it is useful for calculating
offsets within data structures or arrays.
Secondly, it is also used for arithmetic operations. Although not its original purpose,
LEA can be used to perform certain arithmetic operations, such as addition or a combination of multiplication
and addition, all in a single instruction.
This can be particularly efficient in terms of instruction throughput and latency on many processors.
Let us now take a look at a practical example of how LEA is used inside x64dbg.
I have opened the template.exe file inside my x64dbg.
Now let's move to the location where I'm going to input my instructions.
Select dump one and then go to Memory Map to create our array.
Right-click on the data segment, follow dump, and then scroll down to a suitable location which is
empty.
And here I will input my array.
I will create a simple array consisting of four numbers: 11, 22, 33, and
44.
So I'll select the first QWORD.
Right-click, Binary Edit, and then I'll key in 11.
Okay, okay.
Then I'll select the next element of the array.
The next QWORD, right-click, binary edit, and key in 22.
Click okay.
Next, I'll select the third QWORD for the third element of the array.
Right-click, binary edit, and key in 33.
Click okay, and finally the last number.
44.
Click okay.
Now, I've got my base address at this address here.
And first element is this, 11.
Second is this one here.
And third one and fourth one here.
So let's copy this address.
Now copy this address.
And we are going to move the base address to -.
Click okay.
Next, we are going to access the third element of the array, which is this element, 0, 1, 2.
So this is what we are going to do.
We are going to find a way to fetch the address here so that we can get the value stored at that address.
So to do that, we will use the Load Effective Address to calculate this address.
So let's try that.
Now.
Before that, let us, let's initialize our counter - to two.
Why?
Because this index is two. Zero
is this address here.
One is here and two is here.
So let's initialize - with two.
So we move -, two.
Now we do the Load Effective Address.
So we load effective address -.
This is a formula we learned in the previous lesson, so we just redo it here.
Now notice that even though we have the square bracket here, it does not mean we are dereferencing
it to fetch the value stored there.
This is just a convention.
When we use LEA, we need to put a square bracket here.
What it does is just to calculate.
It's just an arithmetic operation here.
It is not a dereference to get a value stored at the address.
So it will take the hex address, the base address is -, and then calculate the offset plus -
times eight and store the new address in -.
So - is storing the new address.
It is not storing the value stored at that address.
Let's confirm this by running and stepping over.
So it loads the base address to -, 403000 is the base address.
Now it's going to move two to -.
So step over and - is now two.
Now it's going to calculate the effective address and store in -.
And if we check -, we get 4030F0.
We are not getting 33.
So that is very important.
Please bear this in mind when you use LEA. With the square bracket, it will not dereference the address.
It will get the calculation and then store the result of the calculation inside your register.
So if you wanted to get the value stored at the address, you have to dereference -.
So to do that, we can do it this way.
Let's say we are going to store the value in -.
So we are going to dereference the address of -.
Okay?
Okay.
So now if you step over, you find that it's going to fetch the value stored at -, which is 33, and
store it in -.
So I step over and you will see - now has got the value 33.
Next, we are going to now see how we can use LEA for its second purpose, which is to calculate, just
as a calculator, this one.
So far, we have already seen how it can be used.
We can use it as an address calculator.
Now we are going to use it as an arithmetic calculator.
So let's try that now.
Assuming I want to perform an arithmetic operation, let's say - times two plus three.
So how do I do that?
So this is how you will do it.
LEA, we're going to store the result in -.
And then we are going to perform the calculation.
So over here, we will type in -.
And then we are going to multiply with two.
And then we are going to plus with three.
And then we click okay.
So again, over here we are not dereferencing an address because - is not an address anyway.
What we are doing is using it as a calculator to calculate this expression and store the result in -.
So let's step over.
Now you check, - has got the value seven.
So let's confirm that. - is two.
Two times two is four, four plus three is seven.
So - holds the value seven.
So this exercise demonstrates how we can use LEA in two different ways.
The first way is to use it to calculate the effective address.
And the second way is to use it as a simple calculator.
So that's all for this video.
Thank you for watching.