0

(Alert: I'm new with all this)

I'm trying to find out what the following (dis)assembly does: 

MOV EAX,DWORD PTR SS:[EBP-54]     ; PTR to ASCII "\xDA\x9Fb"

I seem to understand that the value at address [EBP-54] is copied to EAX. And that OllyDbg figured out that value to be an ascii string containing "\xDA\x9Fb". Is that right?

Can someone maybe explain to me what this Ascii string is supposed to represent, and how it fits in this code example?

Edit: Since the information above seems not sufficient to give an answer, I'll try to add some instructions that might (or might not) shed some light.

Shortly after the instruction above, there are multiple CMPs that each look like this: 

CMP DWORD PTR DS:[EAX+(different hex)],0
JE SHORT (position a few lines below)

This CMP exits with true which is not the desired condition. The left side should have another value than 0.

I could not figure out what the the string means but it is being used as one of multiple arguments in many internal (private) functions of the disassembly while the other arguments would contain column names of a database.

I am planning to do a lot more digging but I was just curious if this seemed familiar to anybody.

Improve this question
6
  • As far as I understand eax will point to the following 4 bytes 0xDA (Ú), 0x9F(Ÿ), 0x62 (b) and 0, which represents the end of the string (according to extended ASCII table). It doesn't look as meaningful string, and generally speaking may represent almost anything imaginable from pointer to floating point number(except of meaningful string, of course). The only way to determine what does it mean is to look what the program does with it.
    – w s
    Commented Nov 5, 2015 at 15:54
  • Thanks w s. I will add some info to my question, maybe it brings more meaning to the situation.
    – vic
    Commented Nov 5, 2015 at 16:04
  • Are comparisons always with zero ?
    – w s
    Commented Nov 5, 2015 at 16:25
  • Yes, with 0. I guess it's a switch statement and 0 is the default case.
    – vic
    Commented Nov 5, 2015 at 16:26
  • 2
    I would assume that it's not a string but, rather a pointer (with value 0x00629FDA) to a structure of some sort. Is that address located in the file you are disassembling ?
    – Ian Cook
    Commented Nov 5, 2015 at 20:48

3 Answers 3

Reset to default
5

As Ian Cook said, the most likely scenario is that this "ASCII" is not a string at all.

Disassemblers like OllyDbg will call pretty much anything "ASCII" if it's zero terminated and does not contain overly crazy control characters, but neither the extended ASCII interpretation "ÚŸb" nor the UTF-8 interpretation "ڟb" (the first character is Arabic) make much sense, so most likely this is a pointer to a record, the first field of which is a pointer to address 0x00629FDA.

Improve this answer
2
  • That's really helpful, and it makes sense. Thank you.
    – vic
    Commented Nov 6, 2015 at 20:48
  • @microtherion no it is not address it is an ascii string and not an escape sequence at that
    – blabb
    Commented Nov 6, 2015 at 21:16
0

Can someone maybe explain to me what this Ascii string is supposed to represent, and how it fits in this code example?

With just that one line of code for context, no, nobody can explain to you what that ASCII string is supposed to represent, nor how it fits into that code example.

Improve this answer
1
  • I guess that's also an answer. Would it help if I said that almost every other line is referencing the "PTR to ASCII "\xDA\x9Fb" in some way? And that it might have come from a database? If not, I guess I'll have to dig deeper myself once more..
    – vic
    Commented Nov 5, 2015 at 15:28
0 
\xdA\9FB = {0x0d,0x41,0x09,0x46,0x62}

0x0d = CR or carriage return
0x09 = tab
so ollldybg showns them as ptr to ascii string
assuming address 401070 holds a string
and 401130 contains 401070
on any access of 401130 ollydbg will dereference the pointer 401070
since it contains an ascii string (ollydbg knows because of its analysis data )
it comments out as PTR to Ascii Data

CPU Disasm
Address   Hex dump     Command                  Comments
004010CD  B8 30114000  MOV EAX, msgbox.00401130 ; PTR to ASCII "A   Fb"

CPU Dump
Address   Hex dump                                ASCII
00401130  70 10 40 00|                            p@

CPU Dump
Address   Hex dump                                ASCII
00401070  0D 41 09 46|62 00                       A Fb

with an actual ascii string 

CPU Disasm
Address   Hex dump       Command                       Comments
004010CD    B8 30114000  MOV     EAX, msgbox.00401130  ; PTR to ASCII "Caption For A Simple "

CPU Dump
Address   Hex dump                                ASCII
00401130  70 10 40 00|                            p@

CPU Dump
Address   Hex dump                                         ASCII
00401070  43 61 70 74|69 6F 6E 20|46 6F 72 20|41 20 53 69| Caption For A Si

enter image description here

Improve this answer
5
  • That's not how the \xHH escape character works.
    – microtherion
    Commented Nov 6, 2015 at 20:13
  • @microtherion did you read the answer who ever said that it is an escape charecter did you see the dump and disassembly in my answer ? dont you see the "A Fb" in the display or just wanted to play being trigger happy ?
    – blabb
    Commented Nov 6, 2015 at 20:31
  • Unfortunately, despite the effort you obviously put into your answer, it's not clear what exactly you're trying to demonstrate here. The very beginning of your message agrees that \x starts a hex escape sequence, but you misinterpret the string because you think the \x is followed by ONE hex character, while it is in fact followed by TWO. The string does not start with 0x0D, it starts with 0xDA, and it does not contain 0x09, it contains 0x9F.
    – microtherion
    Commented Nov 7, 2015 at 17:01
  • if you know c compile execute and disassemble this code and see #include <stdio.h> int main (void){ char *wtf = "\\xDA\\x9Fb"; char **ntf = &wtf; printf("pointer to asciic string %p contains %s\n",*ntf,*ntf); }
    – blabb
    Commented Nov 7, 2015 at 18:40
  • So what you're saying is that the backlashes could be literal ones; this is not out of the question but contradicts the first line of your answer.
    – microtherion
    Commented Nov 8, 2015 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.