I just read this post.
What does mean an "immediate value" ? Is there any string/ascii there?
How can I find this value on the binary file?
I have the same code and when I search on 0x28 address I dont see any value.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
In the area of machine code/instruction sets, an immediate value is a constant number embedded into the instruction itself , as opposed to one loaded from another place. For example, on x86:
6A 03 push 3
Here, 3 is an immediate because it's included directly as part of the opcode (in the second byte).
00 00 50 E3 CMP R0, #0
here, 0 is again an immediate because it's encoded in bits of the opcode. In ARM assembly, immediates are usually marked with
# symbol, although it is optional in later revisions when unambiguous.
C8 30 1F E5 LDR R3, =0xC0B8
Here, despite appearances,
0xC0B8 is not an immediate. If we turn on [x] Disable pointer dereferencing in IDA, it is shown as:
LDR R3, dword_BDE0
B8 C0 00 00 dword_BDE0 DCD 0xC0B8
I.e. this value is not embedded into the instruction but is loaded from the literal pool (an area reserved for storage of values not representable as immediates), but by default IDA simplifies such instructions to show directly the loaded value (this syntax is supported by most ARM assemblers).
An immediate value is a value that is stored in the instruction.
For example (in PIC16 because that's what I'm familiar with):
MOVlw 0x01 MOVwf 0x07h MOVlw 0x01 ADDwf 0x07h,0
What this program does is as follows:
This is a program to show us the difference between a literal (immediate) value and direct addressing.
On the first instruction,
MOVlw 0x01 we move a literal value into the accumulator. This means that the value is taken directly from the instruction, as opposed to being taken from a register which the instruction points to. When the processor reads this instruction, it takes the operand (which in this case is an immediate value), and places it directly into the accumulator. It does not need to make a register or memory access other than that necessary to get the instruction.
On the fourth instruction,
ADDwf 0x07h,0, we do the opposite of the above. Instead of taking the value directly from the instruction, the instruction contains the address that the value is stored in, in memory. So, when the processor reads this instruction, it requests from memory the value located in address
0x07h and does the operation with the value that the memory returns.
As a further example, let's look at how those two instructions might look at the byte level (be aware that this may not be the correct machine code for an actual PIC16 microcontroller):
Let's assume that our instructions have 8 bit opcodes and 8 bit operands.
Our two instructions:
MOVlw 0x01 and
ADDwf 0x07h,0 might become something like:
01 01 and
02 7h 00. This makes it much easier to see what's really going on.
01 01 (
MOVlw 0x01), the value
01 comes directly from the operand field of the instruction. However, in
02 7h 00 (
ADDwf 0x07h,0), the operand
7h is an address where the actual operand (in this case another
01) of the instruction is stored.
An "immediate value" is an hardcoded value included in the program. It is all the static values that are present in a program. For example (if translated to C):
x = 10;
x is a variable and
10 is an immediate value.
Concerning, "where to find the value", it is in the register
r0. I cannot tell more than that. If you do not know what a register is, you may just ask Wikipedia about that.