Search code examples
assemblyx86windbgdisassemblyida

What does parenthesis BEFORE register mean in x86?


While debugging an application with IDA Pro and WinDbg, I came across following statement.

mov esi, ds:(dword_16C6 - 16B2h)[esi]

To simplify, let's say

mov esi, ds:(ABC)[esi]

What does (ABC) mean here?


Solution

  • In Intel syntax, round parenthesis are for grouping, just like in mathematics. This, is done because

    ds:dword_16C6 - 16B2h[esi]
    

    might be interpreted as

    (ds:dword_16C6) - (16B2h[esi])
    

    which doesn't make any sense.

    In AT&T syntax, square brackets are used for grouping instead.


    In other words, it's a complex way of writing ds:[esi + dword_16C6 - 16B2h], or ds:dword_16C6[esi - 16B2h] which are both also valid MASM syntax (I think).

    Some might say unnecessarily complex, but it does give consistency with symbol[index] syntax which this disassembler uses for symbol + register(s) addressing modes.