0

How can I convert the following IDA Pro generated disassembly (assembly language) into a higher level language?

...
mov edx, Var1
mov ecx, Var2
mov eax, edx
imul ecx
mov edx, eax
imul edx, eax
mov Var3, ecx
...

I am trying to write a detailed pseudo code describing the function of the provided assembly snippet.

7

Please note that there is no general 1:1 relation between assembly code and a higher level language, especially if the assembly was crafted manually. And even for compiled code there may be no good translation if the code was heavily optimized.

Also, note that reverse engineering is not about translating assembly to higher level language, it's about figuring out what's going on. For example, a year ago, someone asked this series of questions [1] [2] [3]. That guy meticuously translated a lot of assembly to C and wasn't any wiser; in the end, he could have saved himself 2 months if he had been able to recognize the RSA algorithm from the code.

Of course, a high level language implementation of something might be easier to read than assembly, so translating to high level might be a part of the work, but it's not the biggest part in most cases.

That said, as you have only 2 opcodes, one of which is mov which is the equivalent to an assignment:

mov edx, Var1           ; edx=Var1
mov ecx, Var2           ; ecx=Var2
mov eax, edx            ; eax=edx (=Var1)
imul ecx                ; eax=eax*ecx (=Var1*Var2)
mov edx, eax            ; edx=eax (=Var1*Var2)
imul edx, eax           ; edx=edx*eax (=(Var1*Var2)^2)
mov Var3, ecx           ; var3=ecx (=Var2)

So, your code calculates (Var1*Var2)^2, but then assigns Var2 to Var3, not the calculated result.

If this was a homework question, i'd assume your teacher wanted to see if you're paying attention to detail. Also, it shows that there's no good translation to a high level language, because you don't generally calculate anything in them without using the result. Although, in C, you could have written

(Var1*Var2)*(Var1*Var2);    // note the expression without an assignment
Var3=Var2;

but your compiler would normally throw away the first line of this.

1

I believe what you need is a decompiler.

Snowman is an example of a free decompiler which integrates easily (can be installed as a plugin) with IDA.

  • 1
    And if you don't have IDA, there is retdec.com/decompilation which supports formats ELF, PE and COFF and Intel x86, ARM, ARM+Thumb, MIPS, PIC32 and PowerPC architectures. Note that actual decompilation process is not on your computer but on theirs, and if you are dealing with somewhat secret code you shouldn't use it. – w s Nov 15 '15 at 7:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.