Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

I try to analyze an .exe file and I have always something like that:

MOV EAX, DWORD PTR DS:[ESI]

I search a lot for that and I know that the expression with [...] means that we store the context of ESI in EAX. For example, when I have in ESI the value 00000101 (5 in decimal), then I would represent it in C like this:

    int x = 5;
    int y = x;

Ok, thats fine, but what if I have an address in ESI ? Something like 001B5355 from which i know that it is an address. How would I represent it then? Maybe use something like a pointer which would point to 001B5355 ?

  UnknownType *immediatePointer = &001B5355;

  UnknownType *pointerEAX = *immediatePointer;

I need help because the whole assembly code of the .exe consists of that kind of lines and I do not know how to represent it to imagine how it could implement it.

share|improve this question

2 Answers 2

The instruction

MOV EAX, DWORD PTR DS:[ESI]

takes the contents of the DWORD pointed to by DS:ESI. If you the value of ESI is known to you and is a constant, you could do it in a single line like this:

unsigned eax = *(unsigned *)0x001B5355;

You can make it a little better by splitting it into two parts (as you have done) so that you can name the pointer.

unsigned *ptr = (unsigned *)0x001B5355;
unsigned eax = *ptr;

This assumes that unsigned is a 32-bit quantity with your compiler.

share|improve this answer
    
ok, thanks. You mean it is ok when I assume that it is or can be represented by using the pointer principle/concept ? –  user3097712 Jun 8 at 20:40
    
@user3097712: yes, that's correct, but be careful to use the correct syntax as I've shown in these examples. –  Edward Jun 9 at 11:04

If esi holds 5 mov eax, [esi] will create an access violation as 5 will not be a valid address in normal cases.

and it does not translate to int x = 5 ; int y = x
that is represented by mov eax , esi not mov eax [esi]

pointermagic:\>type pointermagic.cpp

int x = 4;
int *y = &x;
int z = x + *y;
int main (void)
{
    return z + x;
}

pointermagic:\>cl /Zi /nologo pointermagic.cpp /link /RELEASE

pointermagic:\>cdb -c "g main; uf @eip;q" pointermagic.exe 

0:000> cdb: Reading initial command 'g main; uf @eip;q'    
pointermagic!main:
00401000 55              push    ebp
00401001 8bec            mov     ebp,esp
00401003 a140bb4000      mov     eax,dword ptr [pointermagic!z (0040bb40)]
00401008 030500b04000    add     eax,dword ptr [pointermagic!x (0040b000)]
0040100e 5d              pop     ebp
0040100f c3              ret
quit:
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.