Indirect addressing

The term "indirect addressing" is quite self-explanatory. As the name of the mode suggests, the address is somewhere in there, but is not used directly. Instead, it is referenced by a pointer, which may be a register or certain base address (immediate address). For example, the following code calls the same procedure twice. In the first call, the address is retrieved using a pointer stored in the rax register, while in the second call we use a variable that stores the address of the procedure we want to call:

; This goes into code section
push my_proc
lea rax, [rsp]
call qword [rax]
add rsp, 8
call qword [my_proc_address]
;
;
my_proc:
ret

; This goes into data section
my_proc_address dq my_proc

As we can see, in both cases, the operand of the call instruction is a pointer to a location in memory, where the address of the my_proc procedure is stored. This addressing mode may be used in order to harden the obfuscation of the execution flow of a code fragment.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset