-2

For the code below can anyone help with these questions?

xor eax, eax
mov ecx, 5
lea edi, [edx]
rep stosd
mov al, 0xFF
stosw
stosb
stosb
  1. How many times does the 'stosd' operation run? Why?

  2. If edx was storing address 0x4b0000 on the heap, what would edi be after the sequence is complete? Why?

  3. How many bytes on the heap are modified by the code above? Why?

  4. Describe as completely as possible what the code above is doing.

  5. Illustrate precisely how the modified heap space should look given the sequence above.

  • 1
    Is this a homework assignment? – julian Jun 21 '18 at 13:49
  • No, I am trying to teach myself x86 for Malware analysis and the book that I am using does not come with the answers to their questions. – Michael Truro Jun 21 '18 at 13:52
  • Why not just run in a debugger and see what happens? – josh Jun 21 '18 at 19:50
  • @josh if it's live malware I'd rather that the inquirer uses some emulator to step through just those opcodes. It'd be better than executing the live malware up to that point :) ... sounds suspiciously like a homework/assignment, though. This should help. – 0xC0000022L Jun 24 '18 at 20:16
  • 1
    @0xC0000022L Anyone dealing with suspected malware should take appropriate precautions, of course you are right! Emulators, sandboxes, whatever... (I did not downvote, btw). Nothing against questions for homeworks, but an answer to "What have you tried?" from a previous comment, that would be great... – josh Jun 25 '18 at 14:02
1

You can do this yourself! Instead of explaining it all, I'm going to give you some resources to read through.

  1. Read all about STOS* and REP. Read them carefully and process what you're reading! Those two resources explain everything to you insofar as how those instructions work.

  2. Read about the LEA instruction. Since there are no offsets being referenced with edx, the way that instruction is written is effectively the same as mov edi,edx. Knowing that, now what do you think is in edi?

  3. Take some time to really wrap your head around the difference between stack and heap. You may have to read/watch content from multiple sources, but here is a great place to start.

  4. (and 5): Use what you learn from the aforementioned points to address your questions about heap/stack. I HIGHLY recommending using something like WinREPL and/or an assembly emulator to view register states and step through cycles as instructions run. If you want to do this with your code, consider running mov edx,0x4b0000 first so the lea instruction will properly operate with an address that's observable for a command like .read addr size in WinREPL.

Not the answer you're looking for? Browse other questions tagged or ask your own question.