0

I wonder how to link theses instructions (down to register details) to the original C code. Where are the variables (whether they are local variables, global variables, static variables, or parameters for a function), and what are the size of the variables (when applicable):

mov     DWORD PTR [ebp-0x4], 0x8    //DWORD PTR [ebp-0x4]-Global variable
mov     eax, DWORD PTR [ebp+0x8]    // DWORD PTR [ebp+0x8]  global V
lea     eax, [ecx + eax*1]
call    _htons
cmp     [ebp+0x8], 0
ret

And here is my C-code:

#include <stdio.h>

int my_global_var ;

int main() { 
    i = 8;
    my_global_var = htons(i);    
} 
3
  • 1
    Would you please correct the title. All the forum is about Reverse engineering problems
    – Jaafar
    Jul 21, 2017 at 8:35
  • 1
    I fully agree with Mohamad-jaafar! Try to find more specific title next time... I edited your post, but next time I'll just vote to close it.
    – perror
    Jul 21, 2017 at 8:47
  • In general - everything depends on how the compiler was set up at the time the code has been compiled. Most of what you are looking for could be in the debugging information (if the compiler was told to produce a lot of it), or, on the other end of the spectrum, practically all information can be lost, if the complier was doing a lot of optimisation. Jul 23, 2017 at 4:33

1 Answer 1

5

i=8; this is local to your function main
this i is referenced in the disassembled instruction a

a) mov     DWORD PTR [ebp-0x4], 0x8  <-- i local variable

instruction b references my_global_var

b) mov     eax, DWORD PTR [ebp+0x8]

inside a normal function scope all address below ebp (ebp-4,ebp-8,ebp-100) etc are local variable access

all address above ebp (ebp+8 , ebp+1c , ebp + 256) etc access either the arguments that were passed to the function or other global variables that are visible outside the function

ecx as posted is undefined and you probably didnt paste a push instruction also _htons() takes a u_short not an int

u_short WSAAPI htons(
  _In_ u_short hostshort
);

you should post a proper query with code or disassembly that is reproducible trivially by anyone for getting a proper answer

the code that would compile and produce a result would look like this

#include <stdio.h>
#include <windows.h>
#pragma comment(lib,"ws2_32.lib")

int my_global_var ;

int main()
{ 
    u_short i = 8;
    my_global_var = htons(i); 
    printf("%d\n" , my_global_var);    
} 

you should always compile with maximum warnings possible and possibly let the compiler do code analysis if possible to reduce defects

if you are using visual studio you should replicate this command line or use the appropriate settings that reflects these switches in your project

cl /Zi /Od /W4 /analyze:log foo.txt htons.cpp /link /RELEASE

the W4 enables the highest levels of warning the /analyze:log foo.txt does a code analysis and shows what possible defects you have in your code

cat foo.txt
<?xml version="1.0" encoding="UTF-8"?>
<DEFECTS></DEFECTS>

compiled and executed this should produce 2048 or 0x800 as result

_htons basically does this operation

0:000> ?? 8 << 0x8 | 8 >> 0x8
int 0x800
0:000> .enable_long_status 0
0:000> ?? 8 << 0x8 | 8 >> 0x8
int 0n2048

the relevent disassembly the scope and contents of local / global vars would be as below

current src line

0:000> lsa .
     6: 
     7: int main()
     8: { 
     9:     u_short i = 8;
>   10:     my_global_var = htons(i); 
    11:     printf("%d\n" , my_global_var);    
    12: } 

disassembly of the function main

0:000> uf .
htons!main [c:\xxx\htons.cpp @ 8]:
    8 00861000 55              push    ebp
    8 00861001 8bec            mov     ebp,esp
    8 00861003 51              push    ecx
    9 00861004 b808000000      mov     eax,8
    9 00861009 668945fc        mov     word ptr [ebp-4],ax
   10 0086100d 0fb74dfc        movzx   ecx,word ptr [ebp-4]
   10 00861011 51              push    ecx
   10 00861012 e8b9000000      call    htons!htons (008610d0)
   10 00861017 0fb7d0          movzx   edx,ax
   10 0086101a 891578488a00    mov     dword ptr [htons!my_global_var (008a4878)],edx
   11 00861020 a178488a00      mov     eax,dword ptr [htons!my_global_var (008a4878)]
   11 00861025 50              push    eax
   11 00861026 68b0b18900      push    offset htons!__xt_z+0x10 (0089b1b0)
   11 0086102b e860000000      call    htons!printf (00861090)
   11 00861030 83c408          add     esp,8
   12 00861033 33c0            xor     eax,eax
   12 00861035 8be5            mov     esp,ebp
   12 00861037 5d              pop     ebp
   12 00861038 c3              ret

local i

0:000> dv /v /t
0016fc10          unsigned short i = 8

global

0:000> dt /v /t my_global_var
Got address 008a4878 for symbol
htons!my_global_var
0n0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.