What does push dword ptr [eax+22] mean?
I know that eg push eax would save eax to the stack and decrement esp by 4. And the push dword ptr means it needs to push 4 bytes, but then I'm confused. Also if it were [esi+22] would this be the same thing?
The push instruction, much like many other x86 instructions, can take a variety of operands: immediate values, registers, and memory addresses:
push 10 ; pushes the value 10 (32 bits in 32-bit mode)
push eax ; pushes the contents of the 32-bit register eax
push DWORD [ebx + 42] ; pushes 32 bits from the memory location ebx + 42
The register form infers the size from the size of the register. The memory form needs to have the size specified (eg here shown in Intel syntax). For immediate values, the operand size is either 16 or 32 bits; the current mode is default, and the other size can be explicitly selected (eg push WORD 10 in 32-bit mode).
push dword ptr [eax+22] would decrement esp by 4 and then save 4bytes data from memory location ebx + 22 . and pop eax do in a reverse way, first move the bits storeed in esp to esp + 3 to eax , and increment esp by 4.