Código
De esta instrucción lo entiendo todo, pero me puse a buscar que hacía "large" y no encontré casi nada, lo único que encontré fue esto
mov ebx, large fs:0
Citar
SMALL and LARGE can be used determine the width of a displacement:
MOV EAX, [LARGE $1234]
This instruction generates a 'normal' move with a 32-bit displacement ($00001234).
MOV EAX, [SMALL $1234]
The second instruction will generate a move with an address size override prefix and a 16-bit displacement ($1234).
SMALL can be used to save space. The following example generates an address size override and a 2-byte address (in total three bytes)
MOV EAX, [SMALL 123]
as opposed to
MOV EAX, [123]
which will generate no address size override and a 4-byte address (in total four bytes).
La idea que yo tenía era más o meno esa, pero me sorprendió mucho no encontrar esta información nada más que en una página, así que os pregunto vosotros si sabéis lo que es.MOV EAX, [LARGE $1234]
This instruction generates a 'normal' move with a 32-bit displacement ($00001234).
MOV EAX, [SMALL $1234]
The second instruction will generate a move with an address size override prefix and a 16-bit displacement ($1234).
SMALL can be used to save space. The following example generates an address size override and a 2-byte address (in total three bytes)
MOV EAX, [SMALL 123]
as opposed to
MOV EAX, [123]
which will generate no address size override and a 4-byte address (in total four bytes).
Por cierto, si alguien quiere ver el código que estaba mirando, era este
http://www.yersinia.net/payload.txt