0

I'm using IDA PRO to disassemble a function, which produces a control flow that looks like this:

start_IE proc near

Buffer= dword ptr -230h
var_22C= byte ptr -22Ch
hFile= dword ptr -30h
hInternet= dword ptr -2Ch
szAgent= byte ptr -28h
dwNumberOfBytesRead= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8

;Do stuff that has nothing to do with ebp+var22C

mov     al, [ebp+var_22C]
jmp     short return

return:
mov     esp, ebp
pop     ebp
retn
start_IE endp

I've cut out a lot of irrelevant code, but the only 2 times that var_22C appears in this procedure has been shown above.

I'm having a difficult time finding out what value the data pointed to by var_22C will be since it's given no obvious assignment here.

Code before/after the function call in the caller:

mov     ecx, [ebp+var_C]
push    ecx             ; command char
call    start_IE
add     esp, 4
mov     [ebp+var_8], al
movsx   edx, [ebp+var_8]
test    edx, edx
jnz     short success

It only has 1 argument passed to it, which should be arg_0... We see that the return value from Var_22C is placed into [ebp+var_8] back in the caller afterwards.

  • 2
    show the code referencing Buffer. – Igor Skochinsky Mar 6 '17 at 9:34
  • Is it possible that there's a return value variable and it's simply uninitialized? What you're describing is producible from valid C code. – NirIzr Mar 6 '17 at 10:49
2

probably the Buffer variable is accessed indirectly by one of the called functions and var_22C is actually part of the buffer.

|improve this answer|||||
1

As far as I can see this mov al, [ebp+var_22C] command works with 8 bit data (according to name al), and there is a possibility that this var_22C variable is assigned as a part of bigger entity, for example as dword, which will require different offset.

I'd suggest to watch to stack accesses around this offset, specifically ,as @Igor Skochinsky says in comment, in a code related to Buffer.

|improve this answer|||||
  • Usually when thats the case, IDA will identify the byte is also accessed as a dword and will make all references to a dword. – NirIzr Mar 6 '17 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.