I'm trying to reverse engineer an library function back to C/C++ code. But the function that I reverse is almust done, i just need a little bit help for making it compleet.
Here is the assembly code:
0002BB46 | 8B 45 F4 | mov eax,dword ptr ss:[ebp-C] |
0002BB49 | 8B 88 EC 00 00 00 | mov ecx,dword ptr ds:[eax+EC] |
0002BB4F | 89 4D EC | mov dword ptr ss:[ebp-14],ecx |
0002BB52 | 8B 55 F4 | mov edx,dword ptr ss:[ebp-C] |
0002BB55 | 8B 82 F0 00 00 00 | mov eax,dword ptr ds:[edx+F0] |
0002BB5B | 89 45 F0 | mov dword ptr ss:[ebp-10],eax |
0002BB5E | 83 7D EC 00 | cmp dword ptr ss:[ebp-14],0 |
0002BB62 | 0F 8E BA 00 00 00 | jle TestDLL.2BC22 |
0002BB68 | C7 45 E8 00 00 00 00 | mov dword ptr ss:[ebp-18],0 |
0002BB6F | EB 09 | jmp TestDLL.2BB7A |
0002BB71 | 8B 4D E8 | mov ecx,dword ptr ss:[ebp-18] |
0002BB74 | 83 C1 01 | add ecx,1 |
0002BB77 | 89 4D E8 | mov dword ptr ss:[ebp-18],ecx |
0002BB7A | 8B 55 E8 | mov edx,dword ptr ss:[ebp-18] |
0002BB7D | 3B 55 EC | cmp edx,dword ptr ss:[ebp-14] |
0002BB80 | 0F 8D 9C 00 00 00 | jge TestDLL.2BC22 |
0002BB86 | 8B 45 FC | mov eax,dword ptr ss:[ebp-4] |
0002BB89 | 50 | push eax |
0002BB8A | 6A 01 | push 1 |
0002BB8C | 6A 04 | push 4 |
0002BB8E | 8B 4D E8 | mov ecx,dword ptr ss:[ebp-18] |
0002BB91 | 6B C9 14 | imul ecx,ecx,14 |
0002BB94 | 03 4D F0 | add ecx,dword ptr ss:[ebp-10] |
0002BB97 | 51 | push ecx |
0002BB98 | FF 15 38 E1 02 00 | call dword ptr ds:[<&fwrite>] |
0002BB9E | 83 C4 10 | add esp,10 |
0002BBA1 | 8B 55 FC | mov edx,dword ptr ss:[ebp-4] |
0002BBA4 | 52 | push edx |
0002BBA5 | 6A 01 | push 1 |
0002BBA7 | 6A 04 | push 4 |
0002BBA9 | 8B 45 E8 | mov eax,dword ptr ss:[ebp-18] |
0002BBAC | 6B C0 14 | imul eax,eax,14 |
0002BBAF | 8B 4D F0 | mov ecx,dword ptr ss:[ebp-10] |
0002BBB2 | 8D 54 01 04 | lea edx,dword ptr ds:[ecx+eax+4] |
0002BBB6 | 52 | push edx |
0002BBB7 | FF 15 38 E1 02 00 | call dword ptr ds:[<&fwrite>] |
an little explination:
- You see on line 0002BB46 the assembly code: mov eax,dword ptr ss:[ebp-C]
The [ebp - C] means that this is an structure.
and the part of 0002BB86, you see: mov eax,dword ptr ss:[ebp-4] The [ebp - 4] means that this is an FILE*
But this is all that i know, I just need a little example for what this part do. ASM 1:
0002BB46 | 8B 45 F4 | mov eax,dword ptr ss:[ebp-C] |
0002BB49 | 8B 88 EC 00 00 00 | mov ecx,dword ptr ds:[eax+EC] |
0002BB4F | 89 4D EC | mov dword ptr ss:[ebp-14],ecx |
0002BB52 | 8B 55 F4 | mov edx,dword ptr ss:[ebp-C] |
0002BB55 | 8B 82 F0 00 00 00 | mov eax,dword ptr ds:[edx+F0] |
0002BB5B | 89 45 F0 | mov dword ptr ss:[ebp-10],eax
And the second one:
0002BB8E | 8B 4D E8 | mov ecx,dword ptr ss:[ebp-18] |
0002BB91 | 6B C9 14 | imul ecx,ecx,14 |
0002BB94 | 03 4D F0 | add ecx,dword ptr ss:[ebp-10] |
0002BB97 | 51 | push ecx
i know it takes the variabele ebp18 and multiply it with 0x14. And add it to ebp10. But i dont know what ebp10 is. i whas thinking it is an struct or something.
I hope someone can help me, for explaining to me.
Manny thanks.
Here is the source code that I've from the assembly.
typedef struct _EDX
{
DWORD offset0; // edx 0x0 -> needs tp be checked
DWORD offset4; // edx 0x4
char offset64[0x64]; // edx 0x64
char offsetC8[0x20]; // -> new added
DWORD offsetE8; //
DWORD offsetEC; // edx 0xEC
char* offsetF0; // edx 0xF0
char first[0x64];
} EDX, *PEDX;
bool _cdecl WriteAdptInfo(char* filName, PEDX ebpc)
{
if(ebpc != NULL)
{
FILE* file = fopen(filName, "wb");
if(file != NULL)
{
size_t size1 = fwrite(&ebpc->offset4 , sizeof(DWORD), 0x01 ,file);
DWORD var8 = 0;
for(var8; var8 <= ebpc->offset4; var8++)
{
DWORD a = var8 * 0xF4;
PEDX ebpC = ebpc;
ebpC->offset0 += a;
size_t size2 = fwrite(ebpC->first, sizeof(char), sizeof(ebpC->first), file);
size_t size3 = fwrite(ebpC->offset64, sizeof(char), sizeof(ebpC->offset64), file);
size_t size4 = fwrite(ebpC->offsetC8, sizeof(char), sizeof(ebpC->offsetC8), file);
size_t size5 = fwrite(&ebpC->offsetE8, sizeof(DWORD), 0x1, file);
size_t size6 = fwrite(&ebpC->offsetEC, sizeof(DWORD), 0x1, file);
DWORD var14 = ebpC->offsetEC;
char* var10 = ebpC->offsetF0;
if(var14 >= 0)
{
DWORD var18 = 0;
for(var18; var18 <= var14; var18++)
{
DWORD counter = (var18 * 0x14);
// ptr , size, count, file
size_t size7 = fwrite((counter + var10), sizeof(char*), 0x1, file);
size_t size8 = fwrite(var10 +counter + 0x4, sizeof(char*), 0x1, file);
size_t size9 = fwrite(var10 + counter + 0x8, sizeof(char*), 0x1, file);
size_t sizeA = fwrite(var10 + counter + 0xC, sizeof(char*), 0x1, file);
size_t sizeB = fwrite(var10 + counter + 0x10, sizeof(char*), 0x1, file);
}
}
}
}
fclose(file);
return true;
}
return false;
}
