-1

enter image description here

include

 int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){



       MessageBox(0,"Insert argument","",0);
       int i = 0;

       for(i ; *(lpCmd+i)  ; i++ ){



    }
    if(!(i=*(lpCmd+2)-0x30)){
            MessageBox(0,"Success","",0);

    }

        MessageBox(0,"Failed","",0);

return 0;
}

In this picture you will see the

   MOVSX ECX , BYTE PTR DS:[EAX+2]

FROM THE CODE *lpCmd is pointing at the address 00141F6B my question is what does *(lpCmd +2) mean in this code? can you tell me what this *(lpCmd+2) is pointing at?

1
  • 1
    *lpCmd is not pointing at anything, lpCmd is. – josh Nov 20 '16 at 11:13
1

eax is 141f6b in your screen shot
so eax+2 = 141f6d byte ptr ds:[eax+2] == *(BYTE *)141f6d == 0
BYTE *(lpcmd +2 ) == BYTE *(141f6b + 2) == BYTE *(141f6d) == 0

enter image description here

and the disassembly for the WinMain

CPU Disasm
Address  Hex>Command                          Comments
00EA1260 /$  SUB     ESP,68               ; lpcmd.00EA1260(guessed Arg1,Arg2,Arg3,Arg4)
00EA1263 |.  MOV     EAX,[0EB8004]
00EA1268 |.  XOR     EAX,ESP
00EA126A |.  MOV     [ESP+64],EAX             ; ASCII "wo0t"
00EA126E |.  PUSH    EBX
00EA126F |.  MOV     EBX,[ESP+78]
00EA1273 |.  LEA     EAX,[ESP+4]
00EA1277 |.  PUSH    64                       ; /Arg3 = 64
00EA1279 |.  PUSH    0                        ; |Arg2 = 0
00EA127B |.  PUSH    EAX                      ; |Arg1 = ASCII "wo0t"
00EA127C |.  CALL    00EA1F10                 ; \lpcmd.00EA1F10
00EA1281 |.  MOV     AL,[EBX]
00EA1283 |.  ADD     ESP,0C
00EA1286 |.  TEST    AL,AL
00EA1288 |.  JZ      SHORT 00EA12B7
00EA128A |.  PUSH    ESI
00EA128B |.  PUSH    EDI
00EA128C |.  LEA     EDI,[ESP+0C]
00EA1290 |.  MOV     ESI,EBX
00EA1292 |.  SUB     EDI,EBX
00EA1294 |>  /MOVSX   EAX,AL
00EA1297 |.  |PUSH    EAX                     ; /Arg4 = ASCII "wo0t"
00EA1298 |.  |PUSH    OFFSET 00EB1168         ; |Arg3 = ASCII "%c"
00EA129D |.  |LEA     EAX,[ESI+EDI]           ; |
00EA12A0 |.  |PUSH    64                      ; |Arg2 = 64
00EA12A2 |.  |PUSH    EAX                     ; |Arg1 = ASCII "wo0t"
00EA12A3 |.  |CALL    00EA1370                ; \lpcmd.00EA1370
00EA12A8 |.  |MOV     AL,[ESI+1]
00EA12AB |.  |LEA     ESI,[ESI+1]
00EA12AE |.  |ADD     ESP,10
00EA12B1 |.  |TEST    AL,AL
00EA12B3 |.^ \JNZ     SHORT 00EA1294
00EA12B5 |.  POP     EDI
00EA12B6 |.  POP     ESI
00EA12B7 |>  MOVSX   EAX,BYTE PTR [EBX+2]
00EA12BB |.  POP     EBX
00EA12BC |.  SUB     EAX,30
00EA12BF |.  PUSH    0                        ; /Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL
00EA12C1 |.  LEA     EAX,[ESP+4]              ; |
00EA12C5 |.  PUSH    EAX                      ; |Caption = "wo0t"
00EA12C6 |.  JNZ     SHORT 00EA12CF           ; |
00EA12C8 |.  PUSH    OFFSET 00EB116C          ; |ASCII "Success"
00EA12CD |.  JMP     SHORT 00EA12D4           ; |
00EA12CF |>  PUSH    OFFSET 00EB1174          ; |ASCII "Failed"
00EA12D4 |>  PUSH    0                        ; |hOwner = NULL
00EA12D6 |.  CALL    [<&USER32.MessageBoxA>]  ; \USER32.MessageBoxA
00EA12DC |.  MOV     ECX,[ESP+64]
00EA12E0 |.  XOR     EAX,EAX
00EA12E2 |.  XOR     ECX,ESP
00EA12E4 |.  CALL    00EA13F6
00EA12E9 |.  ADD     ESP,68
00EA12EC \.  RETN    10
1
  • which part of dump represent [eax +2]? – kingyum Nov 20 '16 at 9:08
0

it is more of a C question.
lpCmd is probably of type (char**) - a pointer to a string.
EAX is set to point to the string itself. (type char*) The string is "77".
And *(lpCmd+2) means the value of the third byte in the string, that in your case it the '\0'. (the string terminator in C) So ECX==0.

I think that the C code does not match the assembly code, but if I hazzard a guess the code compare the third character of the string with the length of it. If it match, then success. (i.e. "773", "8846")

1
  • no it doesnt compare with length it needs to be 0x30 aka ascii 0 at 3rd position in the argv[1] ie some string like aa0bbx or dd0c0x etc etc op probably posted a ripped out src and ripped things that needs to be in context or the code is plain shabby there is no else clause for example after success so failed will always execute even when you succeed etc – blabb Nov 21 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.