0

I'm trying to reverse this code on windows, what those lines mean?

mov     eax, large fs:18h
mov     eax, [eax+30h]

and

fldz
fstenv  [esp+var_1C]

full code:

mov     eax, large fs:18h
mov     eax, [eax+30h]
push    eax
movzx   eax, byte ptr [eax+2]
call    unkfunc
jnz     loc_4031ED

unkfunc:

var_1C= byte ptr -1Ch

fldz
fstenv  [esp+var_1C]
jmp     short test_eax_eax

test_eax_eax:

test eax,eax
ret
4
  • 1
    Fs:18 teb ; +30 = ptr ti peb ; + 2 = isdebugged
    – blabb
    Jun 19 '16 at 4:33
  • 1
    @blabb why don't you create a proper answer, this comment of yours has almost all qualities of a good answer already. Jun 19 '16 at 4:51
  • @VitalyOsipov it is tedious to type answers from a teenie weenie screen :)
    – blabb
    Jun 20 '16 at 8:25
  • the fldz/fstenv is a way to get the EIP address without using call/pop method Jun 26 '16 at 15:54
3

As I commented code is checking BeingDebugged member of ProcessEnvironmentBlock structure
_PEB is a memebr of ThreadEnvironemntBlock structure _TEB
the call is probably junk / anyway it doesn't alter eax ie eax will not be 0 if you are debugging

0:000> r fs

fs=0000003b

0:000> dd /c 1 [3b:18] L?0x1

003b:00000018  7ffdf000

0:000> ? $teb

Evaluate expression: 2147348480 = 7ffdf000

0:000> dd /c 1 poi([3b:18])+0x30 L?0x1

7ffdf030  7ffd3000

0:000> ? @$peb

Evaluate expression: 2147299328 = 7ffd3000

0:000> db /c 1 poi(poi([3b:18])+0x30) L?0x3

7ffd3000  00  .
7ffd3001  00  .
7ffd3002  01  .

0:000> ?? @$peb->BeingDebugged

unsigned char 0x01 ''

0:000> ? @@c++(&(@$peb->BeingDebugged))

Evaluate expression: 2147299330 = 7ffd3002

0:000> db (poi((@$teb + @@(#FIELD_OFFSET(ntdll!_TEB,ProcessEnvironmentBlock))))) + @@(#FIELD_OFFSET(ntdll!_PEB,BeingDebugged)) l?@@(#RTL_FIELD_SIZE(ntdll!_PEB,BeingDebugged))

7ffd3002  01

some more :)

0:000> db (poi((poi(3b:18) + @@(#FIELD_OFFSET(ntdll!_TEB,ProcessEnvironmentBlock))))) + @@(#FIELD_OFFSET(ntdll!_PEB,BeingDebugged)) l?@@(#RTL_FIELD_SIZE(ntdll!_PEB,BeingDebugged))
7ffd3002  01                                               .
0:000> db (poi((poi(@fs:18) + @@(#FIELD_OFFSET(ntdll!_TEB,ProcessEnvironmentBlock))))) + @@(#FIELD_OFFSET(ntdll!_PEB,BeingDebugged)) l?@@(#RTL_FIELD_SIZE(ntdll!_PEB,BeingDebugged))
7ffd3002  01         

forgot to mention the new born baby viz natvis

0:000> dx &Debugger.State.PseudoRegisters.General.teb[0],1

0x7ffdf000 [Type: _TEB *]
    [0]              [Type: _TEB]

0:000> dx &Debugger.State.PseudoRegisters.General.teb->ProcessEnvironmentBlock

0x7ffdf030 [Type: _PEB * *]
    0x7ffda000 [Type: _PEB *]

0:000> dx &Debugger.State.PseudoRegisters.General.teb->ProcessEnvironmentBlock->BeingDebugged

0x7ffda002 : 0x1 [Type: unsigned char *]
    0x1
                                       .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.