2 added 12 characters in body; edited tags; edited title
source | link

IDA - Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains completelya majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? Could it really just be tonnesa lot of local variables? Or could it actually be a data structure and this is how IDA is representingrepresents it? I have a theory of what this might be but if anyone knewknows what this could mean that would be sweet.

Here's a screenshot: instructions

My guess: This is this is actually a data structure. ebp is the base address of the structure. The mov instructions inbetweenbetween the mov [...], offset value are padding bytes. I'm guessing they are just padding bytes since esi doesn't contain a value (it was xor-ed with itself at the top of the screenshot) and is mov'd epb + offset quite a lot in this block.

Any ideas and advice on what is happening in this screenshot would be appreciated. Thanks.

IDA - Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains completely mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? Could it really just be tonnes of local variables? Or could it actually be a data structure and this is how IDA is representing it? I have a theory of what this might be but if anyone knew what this could mean that would be sweet.

Here's a screenshot: instructions

My guess: This is actually a data structure. ebp is the base address of the structure. The mov instructions inbetween the mov [...], offset value are padding bytes. I'm guessing they are just padding bytes since esi doesn't contain a value (it was xor at the top of the screenshot) and is mov'd epb + offset quite a lot in this block.

Any ideas and advice on what is happening in this screenshot would be appreciated. Thanks.

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? Could it really just be a lot of local variables? Or could it actually be a data structure and this is how IDA represents it? I have a theory of what this might be but if anyone knows what this could mean that would be sweet.

Here's a screenshot: instructions

My guess is this is actually a data structure. ebp is the base address of the structure. The mov instructions between the mov [...], offset value are padding bytes. I'm guessing they are just padding bytes since esi doesn't contain a value (it was xor-ed with itself at the top of the screenshot) and is mov'd epb + offset quite a lot in this block.

Any ideas and advice on what is happening in this screenshot would be appreciated. Thanks.

    Bumped by Community user
1
source | link

IDA - Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains completely mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? Could it really just be tonnes of local variables? Or could it actually be a data structure and this is how IDA is representing it? I have a theory of what this might be but if anyone knew what this could mean that would be sweet.

Here's a screenshot: instructions

My guess: This is actually a data structure. ebp is the base address of the structure. The mov instructions inbetween the mov [...], offset value are padding bytes. I'm guessing they are just padding bytes since esi doesn't contain a value (it was xor at the top of the screenshot) and is mov'd epb + offset quite a lot in this block.

Any ideas and advice on what is happening in this screenshot would be appreciated. Thanks.