How do you recognize a pointer dereference chain (e.g., p->next->value) in assembly?

Look for back-to-back memory reads where the value loaded by the first becomes the base register of the second — each such step is one more -> in the chain.

* Back-to-back loads where the value from one becomes the base register of the next — each step is one more ->. *

# rax = p->next (read pointer from offset 8)
mov  0x8(%rdi), %rax

# edx = p->next->value (read int from offset 0 of what we just loaded)
mov  (%rax), %edx

This is p->next->value: first dereference gets the next pointer, second dereference reads the value field from that node.

Triple dereference (p->next->next->value):

mov  0x8(%rdi), %rax
mov  0x8(%rax), %rax
mov  (%rax), %edx

How to identify: Each mov that loads from (result_of_previous_load) is another pointer follow. Count them to determine the depth of the dereference chain.

Common contexts:

• Linked list traversal: node->next->next
• Tree navigation: node->left->right
• Struct with pointer fields: obj->ref->data

Go deeper:

• Wikipedia — Pointer (computer programming): dereferencing and multiple levels of indirection (*argv, **argv).