1

I'm trying to reverse engineer an app. I can't understand some instructions:

EBP-4h=>Self
EBP-8h=>OptionData
...
mov     eax, [ebp+var_4]
movzx   eax, byte ptr [eax+1Ch]      // (1)
mov     edx, [ebp+var_8]
mov     [edx+8], eax
mov     eax, [ebp+var_4]
movzx   eax, byte ptr [eax+1Dh]     // (2)
mov     edx, [ebp+var_8]
mov     [edx+0Ch], eax
mov     eax, [ebp+var_8]
mov     dword ptr [eax+10h], 1F41h  // (3)
...

Based on reversing other parts of the app, I believe edx+8, edx+0C, edx+10 are all integers; eax+1C is 'scP8B' and eax+1D is 'ocDynamicMR2'.

I don't understand instructions (1) and (2).

  • did you try to look up this instruction in any documentation? – Igor Skochinsky May 29 '18 at 9:15
  • If you are using IDA, you can turn on Auto comments, this option will explain some "basic information" for you. The answer for this question is @Henno Brandsma's response! – tuantm May 30 '18 at 2:21
3

eax + 0x1c is a pointer to bytes, and the value of the byte at that address is put into the register eax where the byte value is “zero-extended” (hence the movzx), so that e.g. a byte 0xdf would become a dword 0x000000df, so not sign-extended. So in C: eax = (unsigned int) b[0x1c], where unsigned char *b is the pointer stored in var_4, say.

  • A nice link to some place where the questioner could look up opcodes in the future would have been awesome. After all none of this is magic and the question is at the level of "please do my homework". – 0xC0000022L May 28 '18 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.