2

I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the eax and edx registers are given a value, their contents are moved to stack variables var_40 and var_44.

Here's said function's initial assembly listing:

var_44= dword ptr -44h
var_40= dword ptr -40h

push    ebp
mov     ebp, esp
add     esp, 0FFFFFFA8h
push    esi
push    edi
mov     [ebp+var_44], edx
mov     [ebp+var_40], eax

I would like to know what are the values of EAX and EDX.

Do they default to 0 since they weren't previously used and this is just an initialization of the local variable? There are other stack variables that IDA declared, I only mentioned var_40 and var_44 since they are the ones I had trouble understanding.

Any help would be greatly appreciated.

  • What calling convention is this function? Are var_44 and var_40 used? – Johann Aydinbas May 17 '18 at 3:04
  • yes they are used but to initialize ecx register later. Thats the only other occurence i could find with them – aatate98 May 17 '18 at 3:11
  • 2
    If this is a Delphi program, then it fits the Borland calling convention (first three arguments in eax, edx, ecx, rest on the stack). That means those two are just regular arguments to the function. – Johann Aydinbas May 17 '18 at 3:38
  • You are giving us too little info to answer this question. It basically depends on ABI. Might be just zeroing/init, might be something else. Is it main method? Other? – Paweł Łukasik May 17 '18 at 6:54
0

TL;DR: The registers are used to pass arguments between the calling function to the callee. In order to understand their values you'll need to look at code prior to it being called.

Since you've mentioned the data stored from the registers is then used to initialize another register before a call, this is a case of data passed between functions using registers.

This may slightly look like saving registers for them to be restored prior to retuning back to the caller, however according to OP the values are not copied back from the stack (var_44, var_40) near the functions return. Additionally, eax is nearly never a preserved register so this is unlikely to be the case.

What are calling conventions

Calling convention is how arguments are passed between caller and callee functions. Wether arguments are stored on the stack, in registers or anyplace else by the caller function prior to calling the callee function, in order for the callee function to read them.

Once we know what calling conventions are, a question raises as to who defined what available calling conventions are available as well as picks the calling convention to use between functions. Obviously, if a caller and callee assume a different calling convention code will break and we'll likely to get a segfault.

Although this question may seem trivial in cases where the same compiler builds both the callee and caller, compiling different binaries by different compilers may complicate things.

You may want to read more about calling conventions used by the compiler/architecture you're reverse engineering.

fastcall calling conventions

There are quite a few x86 calling conventions with several resembling each other but used by different compilers but x64 calling conventions are more standardized.

Originally, calling conventions heavily relied on the stack and all parameters were passed through it, however for performance reasons register usage became more frequent as it avoids the extra memory writes. Since not all data can be stored using registers (and other reasons) these are mixed calling conventions.

These mixed calling conventions are commonly called "fastcall" due to being faster by avoiding the unneeded stack writes. There are several x86 fast calling conventions, depending on compiler used. Although there are several calling conventions take make usage of the eax and edx, but the important thing to note here is that they're used for the values previously set by the calling function.

0

Check what the values of edx and eax are prior to the function call. Since these registers aren’t cleared prior to being moved into the variables their existing values are probably just used and transferred into the local variables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.