1

I'm trying to reverse engineer an library function back to C/C++ code. But the function that I reverse is almust done, i just need a little bit help for making it compleet.

Here is the assembly code:

        0002BB46 | 8B 45 F4                 | mov eax,dword ptr ss:[ebp-C]                                            |
    0002BB49 | 8B 88 EC 00 00 00        | mov ecx,dword ptr ds:[eax+EC]                                           |
    0002BB4F | 89 4D EC                 | mov dword ptr ss:[ebp-14],ecx                                           |
    0002BB52 | 8B 55 F4                 | mov edx,dword ptr ss:[ebp-C]                                            |
    0002BB55 | 8B 82 F0 00 00 00        | mov eax,dword ptr ds:[edx+F0]                                           |
    0002BB5B | 89 45 F0                 | mov dword ptr ss:[ebp-10],eax                                           |
    0002BB5E | 83 7D EC 00              | cmp dword ptr ss:[ebp-14],0                                             |
    0002BB62 | 0F 8E BA 00 00 00        | jle TestDLL.2BC22                                                   |
    0002BB68 | C7 45 E8 00 00 00 00     | mov dword ptr ss:[ebp-18],0                                             |
    0002BB6F | EB 09                    | jmp TestDLL.2BB7A                                                   |
    0002BB71 | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |
    0002BB74 | 83 C1 01                 | add ecx,1                                                               |
    0002BB77 | 89 4D E8                 | mov dword ptr ss:[ebp-18],ecx                                           |
    0002BB7A | 8B 55 E8                 | mov edx,dword ptr ss:[ebp-18]                                           |
    0002BB7D | 3B 55 EC                 | cmp edx,dword ptr ss:[ebp-14]                                           |
    0002BB80 | 0F 8D 9C 00 00 00        | jge TestDLL.2BC22                                                   |
    0002BB86 | 8B 45 FC                 | mov eax,dword ptr ss:[ebp-4]                                            |
    0002BB89 | 50                       | push eax                                                                |
    0002BB8A | 6A 01                    | push 1                                                                  |
    0002BB8C | 6A 04                    | push 4                                                                  |
    0002BB8E | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |
    0002BB91 | 6B C9 14                 | imul ecx,ecx,14                                                         |
    0002BB94 | 03 4D F0                 | add ecx,dword ptr ss:[ebp-10]                                           |
    0002BB97 | 51                       | push ecx                                                                |
    0002BB98 | FF 15 38 E1 02 00        | call dword ptr ds:[<&fwrite>]                                           |
0002BB9E | 83 C4 10                 | add esp,10                                                              |
0002BBA1 | 8B 55 FC                 | mov edx,dword ptr ss:[ebp-4]                                            |
0002BBA4 | 52                       | push edx                                                                |
0002BBA5 | 6A 01                    | push 1                                                                  |
0002BBA7 | 6A 04                    | push 4                                                                  |
0002BBA9 | 8B 45 E8                 | mov eax,dword ptr ss:[ebp-18]                                           |
0002BBAC | 6B C0 14                 | imul eax,eax,14                                                         |
0002BBAF | 8B 4D F0                 | mov ecx,dword ptr ss:[ebp-10]                                           |
0002BBB2 | 8D 54 01 04              | lea edx,dword ptr ds:[ecx+eax+4]                                        |
0002BBB6 | 52                       | push edx                                                                |
0002BBB7 | FF 15 38 E1 02 00        | call dword ptr ds:[<&fwrite>]                                           |

an little explination: - You see on line 0002BB46 the assembly code: mov eax,dword ptr ss:[ebp-C]
The [ebp - C] means that this is an structure.

and the part of 0002BB86, you see: mov eax,dword ptr ss:[ebp-4] The [ebp - 4] means that this is an FILE*

But this is all that i know, I just need a little example for what this part do. ASM 1:

 0002BB46 | 8B 45 F4                 | mov eax,dword ptr ss:[ebp-C]                                            |
0002BB49 | 8B 88 EC 00 00 00        | mov ecx,dword ptr ds:[eax+EC]                                           |
0002BB4F | 89 4D EC                 | mov dword ptr ss:[ebp-14],ecx                                           |
0002BB52 | 8B 55 F4                 | mov edx,dword ptr ss:[ebp-C]                                            |
0002BB55 | 8B 82 F0 00 00 00        | mov eax,dword ptr ds:[edx+F0]                                           |
0002BB5B | 89 45 F0                 | mov dword ptr ss:[ebp-10],eax 

And the second one:

0002BB8E | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |
0002BB91 | 6B C9 14                 | imul ecx,ecx,14                                                         |
0002BB94 | 03 4D F0                 | add ecx,dword ptr ss:[ebp-10]                                           |
0002BB97 | 51                       | push ecx           

i know it takes the variabele ebp18 and multiply it with 0x14. And add it to ebp10. But i dont know what ebp10 is. i whas thinking it is an struct or something.

I hope someone can help me, for explaining to me.

Manny thanks.

Here is the source code that I've from the assembly.

typedef struct _EDX  
{

    DWORD offset0;         // edx 0x0 -> needs tp be checked          
    DWORD offset4;        // edx 0x4                                  
    char offset64[0x64];  // edx 0x64                                 
    char offsetC8[0x20];  // -> new added                             
    DWORD offsetE8;       //                                          
    DWORD offsetEC;       // edx 0xEC                                 
    char* offsetF0;       // edx 0xF0                                

    char first[0x64];
} EDX, *PEDX;

bool _cdecl WriteAdptInfo(char* filName, PEDX ebpc) 
{
    if(ebpc != NULL)
    {
        FILE* file = fopen(filName, "wb");
        if(file != NULL)
        {
            size_t size1 = fwrite(&ebpc->offset4 , sizeof(DWORD), 0x01 ,file); 
            DWORD var8 = 0; 
            for(var8; var8 <= ebpc->offset4; var8++) 
            {
                DWORD a = var8 * 0xF4;
                PEDX ebpC = ebpc;
                ebpC->offset0 += a;
                size_t size2 = fwrite(ebpC->first, sizeof(char), sizeof(ebpC->first), file);
                size_t size3 = fwrite(ebpC->offset64, sizeof(char), sizeof(ebpC->offset64), file);
                size_t size4 = fwrite(ebpC->offsetC8, sizeof(char), sizeof(ebpC->offsetC8), file);
                size_t size5 = fwrite(&ebpC->offsetE8, sizeof(DWORD), 0x1, file);
                size_t size6 = fwrite(&ebpC->offsetEC, sizeof(DWORD), 0x1, file);

                DWORD var14 = ebpC->offsetEC;
                char* var10 = ebpC->offsetF0;

                if(var14 >= 0)
                {
                    DWORD var18 = 0;
                    for(var18; var18 <= var14; var18++)
                    {
                        DWORD counter = (var18 * 0x14);
                        //     ptr , size, count, file
                        size_t size7 = fwrite((counter + var10), sizeof(char*), 0x1, file);
                        size_t size8 = fwrite(var10 +counter + 0x4, sizeof(char*), 0x1, file);
                        size_t size9 = fwrite(var10 + counter + 0x8, sizeof(char*), 0x1, file);
                        size_t sizeA = fwrite(var10 + counter + 0xC, sizeof(char*), 0x1, file);
                        size_t sizeB = fwrite(var10 + counter + 0x10, sizeof(char*), 0x1, file);
                    }
                }
            } 
        }
        fclose(file);
        return true;
    }
    return false;
}
5
  • 0002BB55 | 8B 82 F0 00 00 00 | mov eax,dword ptr ds:[edx+F0] | 0002BB5B | 89 45 F0 | mov dword ptr ss:[ebp-10],eax your ebp-10 is filled up here it was whatever was there in the [edx+f0] first define the structure and its members and then re read the assembly to correlate
    – blabb
    Aug 27, 2016 at 10:22
  • So if i understand, it well, the F0 is the offset of the structure? Its simular to this assembly: MOV EDX, DWORD PTR SS:[EBP - 10] ADD EDX, F0
    – Avo18
    Aug 27, 2016 at 11:06
  • What do you have, in C or C++? (These are 2 different languages.)
    – Jongware
    Aug 27, 2016 at 15:57
  • @Avo18 no that is not correct i added an answer take a look )
    – blabb
    Aug 27, 2016 at 19:21
  • @Rad Lexus below you can find my C++ code
    – Avo18
    Aug 29, 2016 at 13:38

1 Answer 1

3

the assembly in question has some structure defined and manipulates some members of the structure

the code in c/c++ could look something similar to whats shown in source window and the disassembly that you are working with is highlighted in blue in the screen shot below

enter image description here

2
  • which tool is this
    – Abr001am
    Aug 28, 2016 at 20:12
  • Windbg ,,,,,,,,,,
    – blabb
    Aug 29, 2016 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.