1

I'm trying to reverse engineer an library function back to C/C++ code. But the function that I reverse is almust done, i just need a little bit help for making it compleet.

Here is the assembly code:

        0002BB46 | 8B 45 F4                 | mov eax,dword ptr ss:[ebp-C]                                            |
    0002BB49 | 8B 88 EC 00 00 00        | mov ecx,dword ptr ds:[eax+EC]                                           |
    0002BB4F | 89 4D EC                 | mov dword ptr ss:[ebp-14],ecx                                           |
    0002BB52 | 8B 55 F4                 | mov edx,dword ptr ss:[ebp-C]                                            |
    0002BB55 | 8B 82 F0 00 00 00        | mov eax,dword ptr ds:[edx+F0]                                           |
    0002BB5B | 89 45 F0                 | mov dword ptr ss:[ebp-10],eax                                           |
    0002BB5E | 83 7D EC 00              | cmp dword ptr ss:[ebp-14],0                                             |
    0002BB62 | 0F 8E BA 00 00 00        | jle TestDLL.2BC22                                                   |
    0002BB68 | C7 45 E8 00 00 00 00     | mov dword ptr ss:[ebp-18],0                                             |
    0002BB6F | EB 09                    | jmp TestDLL.2BB7A                                                   |
    0002BB71 | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |
    0002BB74 | 83 C1 01                 | add ecx,1                                                               |
    0002BB77 | 89 4D E8                 | mov dword ptr ss:[ebp-18],ecx                                           |
    0002BB7A | 8B 55 E8                 | mov edx,dword ptr ss:[ebp-18]                                           |
    0002BB7D | 3B 55 EC                 | cmp edx,dword ptr ss:[ebp-14]                                           |
    0002BB80 | 0F 8D 9C 00 00 00        | jge TestDLL.2BC22                                                   |
    0002BB86 | 8B 45 FC                 | mov eax,dword ptr ss:[ebp-4]                                            |
    0002BB89 | 50                       | push eax                                                                |
    0002BB8A | 6A 01                    | push 1                                                                  |
    0002BB8C | 6A 04                    | push 4                                                                  |
    0002BB8E | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |
    0002BB91 | 6B C9 14                 | imul ecx,ecx,14                                                         |
    0002BB94 | 03 4D F0                 | add ecx,dword ptr ss:[ebp-10]                                           |
    0002BB97 | 51                       | push ecx                                                                |
    0002BB98 | FF 15 38 E1 02 00        | call dword ptr ds:[<&fwrite>]                                           |
0002BB9E | 83 C4 10                 | add esp,10                                                              |
0002BBA1 | 8B 55 FC                 | mov edx,dword ptr ss:[ebp-4]                                            |
0002BBA4 | 52                       | push edx                                                                |
0002BBA5 | 6A 01                    | push 1                                                                  |
0002BBA7 | 6A 04                    | push 4                                                                  |
0002BBA9 | 8B 45 E8                 | mov eax,dword ptr ss:[ebp-18]                                           |
0002BBAC | 6B C0 14                 | imul eax,eax,14                                                         |
0002BBAF | 8B 4D F0                 | mov ecx,dword ptr ss:[ebp-10]                                           |
0002BBB2 | 8D 54 01 04              | lea edx,dword ptr ds:[ecx+eax+4]                                        |
0002BBB6 | 52                       | push edx                                                                |
0002BBB7 | FF 15 38 E1 02 00        | call dword ptr ds:[<&fwrite>]                                           |

an little explination: - You see on line 0002BB46 the assembly code: mov eax,dword ptr ss:[ebp-C]
The [ebp - C] means that this is an structure.

and the part of 0002BB86, you see: mov eax,dword ptr ss:[ebp-4] The [ebp - 4] means that this is an FILE*

But this is all that i know, I just need a little example for what this part do. ASM 1:

 0002BB46 | 8B 45 F4                 | mov eax,dword ptr ss:[ebp-C]                                            |
0002BB49 | 8B 88 EC 00 00 00        | mov ecx,dword ptr ds:[eax+EC]                                           |
0002BB4F | 89 4D EC                 | mov dword ptr ss:[ebp-14],ecx                                           |
0002BB52 | 8B 55 F4                 | mov edx,dword ptr ss:[ebp-C]                                            |
0002BB55 | 8B 82 F0 00 00 00        | mov eax,dword ptr ds:[edx+F0]                                           |
0002BB5B | 89 45 F0                 | mov dword ptr ss:[ebp-10],eax 

And the second one:

0002BB8E | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |
0002BB91 | 6B C9 14                 | imul ecx,ecx,14                                                         |
0002BB94 | 03 4D F0                 | add ecx,dword ptr ss:[ebp-10]                                           |
0002BB97 | 51                       | push ecx           

i know it takes the variabele ebp18 and multiply it with 0x14. And add it to ebp10. But i dont know what ebp10 is. i whas thinking it is an struct or something.

I hope someone can help me, for explaining to me.

Manny thanks.

Here is the source code that I've from the assembly.

typedef struct _EDX  
{

    DWORD offset0;         // edx 0x0 -> needs tp be checked          
    DWORD offset4;        // edx 0x4                                  
    char offset64[0x64];  // edx 0x64                                 
    char offsetC8[0x20];  // -> new added                             
    DWORD offsetE8;       //                                          
    DWORD offsetEC;       // edx 0xEC                                 
    char* offsetF0;       // edx 0xF0                                

    char first[0x64];
} EDX, *PEDX;

bool _cdecl WriteAdptInfo(char* filName, PEDX ebpc) 
{
    if(ebpc != NULL)
    {
        FILE* file = fopen(filName, "wb");
        if(file != NULL)
        {
            size_t size1 = fwrite(&ebpc->offset4 , sizeof(DWORD), 0x01 ,file); 
            DWORD var8 = 0; 
            for(var8; var8 <= ebpc->offset4; var8++) 
            {
                DWORD a = var8 * 0xF4;
                PEDX ebpC = ebpc;
                ebpC->offset0 += a;
                size_t size2 = fwrite(ebpC->first, sizeof(char), sizeof(ebpC->first), file);
                size_t size3 = fwrite(ebpC->offset64, sizeof(char), sizeof(ebpC->offset64), file);
                size_t size4 = fwrite(ebpC->offsetC8, sizeof(char), sizeof(ebpC->offsetC8), file);
                size_t size5 = fwrite(&ebpC->offsetE8, sizeof(DWORD), 0x1, file);
                size_t size6 = fwrite(&ebpC->offsetEC, sizeof(DWORD), 0x1, file);

                DWORD var14 = ebpC->offsetEC;
                char* var10 = ebpC->offsetF0;

                if(var14 >= 0)
                {
                    DWORD var18 = 0;
                    for(var18; var18 <= var14; var18++)
                    {
                        DWORD counter = (var18 * 0x14);
                        //     ptr , size, count, file
                        size_t size7 = fwrite((counter + var10), sizeof(char*), 0x1, file);
                        size_t size8 = fwrite(var10 +counter + 0x4, sizeof(char*), 0x1, file);
                        size_t size9 = fwrite(var10 + counter + 0x8, sizeof(char*), 0x1, file);
                        size_t sizeA = fwrite(var10 + counter + 0xC, sizeof(char*), 0x1, file);
                        size_t sizeB = fwrite(var10 + counter + 0x10, sizeof(char*), 0x1, file);
                    }
                }
            } 
        }
        fclose(file);
        return true;
    }
    return false;
}
  • 0002BB55 | 8B 82 F0 00 00 00 | mov eax,dword ptr ds:[edx+F0] | 0002BB5B | 89 45 F0 | mov dword ptr ss:[ebp-10],eax your ebp-10 is filled up here it was whatever was there in the [edx+f0] first define the structure and its members and then re read the assembly to correlate – blabb Aug 27 '16 at 10:22
  • So if i understand, it well, the F0 is the offset of the structure? Its simular to this assembly: MOV EDX, DWORD PTR SS:[EBP - 10] ADD EDX, F0 – Avo18 Aug 27 '16 at 11:06
  • What do you have, in C or C++? (These are 2 different languages.) – usr2564301 Aug 27 '16 at 15:57
  • @Avo18 no that is not correct i added an answer take a look ) – blabb Aug 27 '16 at 19:21
  • @Rad Lexus below you can find my C++ code – Avo18 Aug 29 '16 at 13:38
3

the assembly in question has some structure defined and manipulates some members of the structure

the code in c/c++ could look something similar to whats shown in source window and the disassembly that you are working with is highlighted in blue in the screen shot below

enter image description here

  • which tool is this – Abr001am Aug 28 '16 at 20:12
  • Windbg ,,,,,,,,,, – blabb Aug 29 '16 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.