2

I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions:

    pusha                      (1)
    pushf                      (2)
    xor ebp, ebp
    jmp add_eh

add_eh:
    mov eax, ss:off_4025E5[ebp]
    mov dword ptr ss:(loc_402159+1)[ebp], eax
    push offset loc_40215f                (3)
    push dword ptr fs:0
    mov fs:0, esp                        (4)
    mov eax, [esp+2Ch]                    (5)
    cmp [eax+IMAGE_DOS_HEADER.e_magic], 'ZM'
    jnz short loc_40206C

I reproduced on paper the stack until the instruction marked with (5), it seems that at (5) the esp+2Ch is pointing above the first register(AX) pushed by (1).

Where does esp+2Ch point and what can be it's value?

Thank you!

Improve this question

1 Answer 1

Reset to default
1

based on the corrected sequence that instruction fetches the dword prior to all the pushes 

pusha pushes 8 general purpose register  = 0x20   = 0x20
pushf pushes 1 flag register             = 0x04   = 0x24

ebp is 0
mov eax, is/can/maybe junk anyway doesn't alter the stack
the next instuction also doesnt alter the stack 

the next 2 pushes alter the stack        = 0x08   = 0x2c

the next instruction sets the seh handler

so it fetches the DWORD from the stack prior to pusha

if this was starting of a call this DWORD could be return address of the call it can be from a earlier push instruction or moved to stack prior to pusha

just to clarify i assembled the instuction in place somewhere in ollydbg and traced through it see the output below

main    ntdll.76E96F51  NOP
main    ntdll.76E96F52  NOP
main    ntdll.76E96F53  NOP
main    ntdll.76E96F54  NOP
main    ntdll.76E96F55  PUSH    0BA0000 [0020F99C]=00000000 ESP=0020F99C
main    ntdll.76E96F5A  PUSHAD      ESP=0020F97C
main    ntdll.76E96F5B  PUSHFD  [0020F978]=76E212AD ESP=0020F978
main    ntdll.76E96F5C  XOR     EBP, EBP
main    ntdll.76E96F5E  MOV     EAX, DWORD PTR SS:[EBP+calc.0BA25E5]    [00BA25E5]=0F087E3B EAX=0F087E3B
main    ntdll.76E96F64  MOV     DWORD PTR SS:[EBP+calc.ULongAdd], EAX   [00BA215A]=0F087E3B
main    ntdll.76E96F6A  PUSH    0BA215F [0020F974]=0020F9F4 ESP=0020F974
main    ntdll.76E96F6F  PUSH    DWORD PTR FS:[0]    [7FFDF000]=0020F9A0 ESP=0020F970
main    ntdll.76E96F76  MOV     DWORD PTR FS:[0], ESP   [7FFDF000]=0020F9A0
main    ntdll.76E96F7D  MOV     EAX, DWORD PTR SS:[ESP+2C]  [0020F99C]=00BA0000 EAX=00BA0000
Improve this answer
4
  • 1
    Unless the op messed up some instructions (however it seems he did, looking at that strange push referencing fs), the [esp+2C] isn't in fs. Without actually calculating offsets, i'd have assumed this restores eax which gets smashed a few instructions earlier. In cases like this, it's much easier to single-step a debugger a few times than trying to figure out manually.
    – Guntram Blohm
    Commented Jun 5, 2016 at 23:00
  • I have added two new instructions that possibly make it easier to understand the ASM snippet.
    – c70u
    Commented Jun 7, 2016 at 8:27
  • Added the correct sequence of instructions, sorry for the mistake.
    – c70u
    Commented Jun 8, 2016 at 6:37
  • @ner0x652 edited my answer you need to know what was on the stack prior to pusha to know what will be in eax after all these instruction
    – blabb
    Commented Jun 8, 2016 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.