I just started learning about reconstructing C code from assembler instructions.
I have the following piece of assembler code:
mov eax dword ptr [ebp+8]
add eax, dword ptr[ebp-4]
movsx ecx, byte ptr [eax]
test ecx, ecx
jne XXXXX
comp dword ptr [ebp-4], ffh
jle XXXX
I want to reconstruct the condition of these lines but I have some problems or things I am not sure about: I re-constructed the following:
Let,ebp+8= param1
and ebp-4 = i
if(param1[i]!=’\0’ || i<=0xff){
…
}
But I am wondering about this line:
movsx ecx, byte ptr [eax]
As I understand movsx
it moves a signed value into a register and sign-extends it with 1. Thus, ecx
shouble look something like 0xFFFFFF<eax>
. Because only the lower bytes (byte ptr eax
) of eax are moved and ecx is 1 extended. Where am I wrong?
if (array[i] != 0 && i < MAXCOUNT)
-- AND instead of ORjne
jumps right after thejle
. Thejle
jumps to the function prolog. I know that usually it would beif (array[i] != 0 && i < MAXCOUNT)
but to me it looks differently.