0

I have the following assembly line 

 test byte ptr [esp + 44h], 1
 jmp SomeCode; 
 .....

from a further analysis, I know that esp points at wShowWindow of the STARTUPINFO structure. I have written the following: 

STARTUPINFO *esp_pointer;
esp_pointer -> wShowWindow; 
if(*(esp_pointer) != 1){
    SomeCode;
}

Is that a right transformation in C ? What do you mean?

best regards,

Improve this question
1
  • esp_pointer -> wShowWindow is located at 0x30 0r 0n48 not at either 0x44 or at 0n44 you have some wrong analysis also when doing STARTUPINFO *esppointer you need to allocate space for the struct with some malloc etc prior to accessing members else you end up with a crash STARTUPINFOA *psi = ( STARTUPINFOA * ) calloc(1,sizeof(STARTUPINFOA)); psi->cb = sizeof(STARTUPINFO); if(psi->wShowWindow ) { printf("foo"); }
    – blabb
    Commented Sep 10, 2014 at 20:07

1 Answer 1

Reset to default
1
  • Don't try to translate assembly to C line by line. You can't.
  • The assembly you posted is probably wrong. A jmp is an unconditonal jump; what follows after a test instruction is normally a jz or jnz which jump depending on the result of the test.
  • You say esp points at wShowWindow. That would mean [esp+44h] points at something way behind the structure, which makes no sense. Maybe what you wanted to say is "I know i have a STARTUPINFO structure on the stack at 14h, so [esp+44h] should be the wShowWindow component" ?
  • If you're right with STARTUPINFO somewhere on the stack - it can't be directly at [esp], as mentioned - please make sure [esp+44h] is wShowWindow, not dwFlags, as the test operation would make much more sense with the dwFlags bitmap than an integer.

All that said, test tests if a bit is set; a compare would be a cmp. So if you really really want an example in C, it would look something like

STARTUPINFO p;
p=(STARTUPINFO *) ((char *) esp+0x14);   // this assumes the structure starts 
                                         // at offset 0x14 from esp
if (p->wShowWindow & 1) {                // access the wShowWindow component at offset
                                         // 0x30 in the structure, which is 0x44 from esp
    ....
}

Note i didn't include the SomeCode, as the "jump there" might just mean "skip some instructions", and your unconditional jump seems to be wrong anyways.

Please, when posting a question next time, be a bit more precise in what you ask and what you copy/paste.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.