I have the following assembly code and I wanted to transform it into the C language. During the transformation, I had some question for which I could not find any answers.
So, here is it:
...
+---->6C250EAD MOV DL, BYTE PTR DS:[ESI]
| .....EAF TEST DL, DL
| .....EB1 JE SHORT func.6C250EDF -----------------+
| .....EB3 MOVZX EDX, DL |
| .....EB6 TEST BYTE PTR DS:[EDX+0x6C25EF39],0x4 |
| .....EBD JE SHORT func.6C250ECE -----+ |
| .....EBF ADD DWORD PRT DS:[ECX],0x2 | |
| .....EC2 TEST EAX,EAX | |
| .....EC4 JE SHORT func.6C250ED9 ----------+ |
| .....EC6 MOV DL, BYTE PTR DS:[ESI] | | |
| .....EC8 INC ESI | | |
| .....EC9 MOV BYTE PTR DS:[EAX], DL | | |
| .....ECB INC EAX | | |
| +--.....ECC-----JMP SHORT func.6C250ED4 | | |
| | 6C250ECE INC DWORD PTR DS:[ECX]<<<<<<--+ | |
| | .....ED0 TEST EAX, EAX | |
| | .....ED2 JMP SHORT func.6C250ED9 -----------+ |
| +->6C250ED4 MOV DL, BYTE PTR DS:[ESI] | | |
| .....ED6 MOV BYTE PTR DS:[EAX],DL | | |
| .....ED8 INC EAX | | |
| 6C250ED9 INC ESI <<<<<-----------------+--+ |
| .....EDA CMP BYTE PTR DS:[ESI],0x22 |
+-----.....EDD-----JNZ SHORT func.6C250EAD |
6C250EDF ..... <<<<------------------------------+
First of all, I must say that we have a string stored in the register ESI. Specially, it is the path of the current process which I try to examine. So it begins with "C:\Users...(and so on)"
My observation was the following. It is a routine which represents a loop. The loop goes through the stored string by increasing the esi pointer at the end of the loop. There is also a counter ECX which is incremented. My question was about the line:
TEST BYTE PTR DS:[EDX+0x6C25EF39],0x4
Here, ollydbg announces me that I the ANSCII code 08 is in [EDX+0x6C25EF39]. I look that up and that is the code for the backspace. Furthermore, 0x4 is the representation for EOT (= End of transmission). Honestly, I do not understand really what is does. (I assume that it is maybe delete the last current character because it is not the "end of transmission", thus 0x4, but I am not sure.) The only thing which I can say about that is that it the result is always ZF=1, so the jumps is taken, and we go to the target of arrow, namely to the place where the counter ECX is incremented. About ECX and EAX I can say that they are initialized with 0.
So, from that observations I try to write a C code to imagine how it could be written in real:
while(esi != NULL){
char *dl = *(esi);
if(dl != dl){
break;
}
char *edx = *(dl);
//at that the line which I do not understand really comes
ecx++;
if(eax!=0){
esi++;
}
if(esi-- == esi){
break;
}
}
I wanted to add that I also try to learn C language. So, I hope you can tell me my mistakes or other wrong things, which I must learn better.