Does x64dbg display the whole memory info even for a simple program opened?

Question

I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below.

#include <stdio.h>

void main()
{
    int x, y, z;

    while(1)
    {
        x = 0;
        y = 1;
        do
        {
            printf("%d\n", x);

            z = x + y;
            x = y;
            y = z;
        } while (x < 255);
    }

}

After compiled the program, I use x64dbg opened the compiled output file project1.exe.

Why for such a simple program, x64dbg displays this huge amount of assembly code (this seems happen to other disassembler too)? See the scroll bar you get it. Is it because x64dbg show all memory info here? If so, that means I can find all other programs running on my computer from this panel, right?

Thanks in advance for any clarification. This is probably a noob question but I can't find the answer online.

Answer 1

The image in query can't be viewed.

I assume you are asking ----

why I can't see the assembly code pertaining to my code portion only and what are those extra assembly code which I didn't seem to write staring at me

The apparently extra code that is shown while you disassemble a console application are inserted by the compiler and is called c runtime initialization code aka CRT code.

A console application needs an input mechanism and an output mechanism so before your code is called the compiler puts those code in place you can find the source for such code in your visual studio directory under

C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime>cd ..

C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src>ls
arm  concrt  i386  linkopts  stl  vccorlib  vcruntime  x64

C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src>cd vcruntime

C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime>ls *main*
dll_dllmain.cpp       exe_main.cpp     exe_wmain.cpp     ManagedMain.cpp
dll_dllmain_stub.cpp  exe_winmain.cpp  exe_wwinmain.cpp  vcruntime_dllmain.cpp

C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime>cat exe_main.cpp
//
// exe_wwinmain.cpp
//
//      Copyright (c) Microsoft Corporation. All rights reserved.
//
// The mainCRTStartup() entry point, linked into client executables that
// uses main().
//
#define _SCRT_STARTUP_MAIN
#include "exe_common.inl"



extern "C" int mainCRTStartup()
{
    return __scrt_common_main();
}

C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime> 

If you don't want to see such code do not create a console app but write a bare-minimum windows app and handle all the input and output mechanisms on your own.

for example, your code can be rewritten like this:

#include <windows.h>

void mymain() {
    int x, y, z;
    char buff[0x100];

    while(1)
    {
        x = 0;
        y = 1;
        do
        {
            wsprintf(buff , "%d\n", x);
            MessageBoxA(NULL,buff,"test",MB_OK);

            z = x + y;
            x = y;
            y = z;
        } while (x < 255);
    }

}

and compiled an linked like this from vc command prompt (you can set these options from project settings also but i wont get into discussing property pages here)

cl /GS-  /Zi /W4 /analyze /nologo /Od bare.cpp /link /release /entry:mymain /subsystem:windows user32.lib

/GS disables buffer security checks /entry says to the compile i dont want all the stuff you drop into my binary just start from here.

/subsystem:windows says I don't want your black screen blinking at me.

I will write on my own hyperspace and read through telepathy and bingo you get a slim and trim 3 kb excutable with just this disassembly.

dumpbin /disasm bare.exe
Microsoft (R) COFF/PE Dumper Version 14.14.26430.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file bare.exe

File Type: EXECUTABLE IMAGE

?mymain@@YAXXZ:
  00401000: 55                 push        ebp
  00401001: 8B EC              mov         ebp,esp
  00401003: 81 EC 0C 01 00 00  sub         esp,10Ch
  00401009: B8 01 00 00 00     mov         eax,1
  0040100E: 85 C0              test        eax,eax
  00401010: 74 5D              je          0040106F
  00401012: C7 45 FC 00 00 00  mov         dword ptr [ebp-4],0
            00
  00401019: C7 45 F8 01 00 00  mov         dword ptr [ebp-8],1
            00
  00401020: 8B 4D FC           mov         ecx,dword ptr [ebp-4]
  00401023: 51                 push        ecx
  00401024: 68 10 20 40 00     push        402010h
  00401029: 8D 95 F4 FE FF FF  lea         edx,[ebp-10Ch]
  0040102F: 52                 push        edx
  00401030: FF 15 04 20 40 00  call        dword ptr [__imp__wsprintfA]
  00401036: 83 C4 0C           add         esp,0Ch
  00401039: 6A 00              push        0
  0040103B: 68 14 20 40 00     push        402014h
  00401040: 8D 85 F4 FE FF FF  lea         eax,[ebp-10Ch]
  00401046: 50                 push        eax
  00401047: 6A 00              push        0
  00401049: FF 15 00 20 40 00  call        dword ptr [__imp__MessageBoxA@16]
  0040104F: 8B 4D FC           mov         ecx,dword ptr [ebp-4]
  00401052: 03 4D F8           add         ecx,dword ptr [ebp-8]
  00401055: 89 4D F4           mov         dword ptr [ebp-0Ch],ecx
  00401058: 8B 55 F8           mov         edx,dword ptr [ebp-8]
  0040105B: 89 55 FC           mov         dword ptr [ebp-4],edx
  0040105E: 8B 45 F4           mov         eax,dword ptr [ebp-0Ch]
  00401061: 89 45 F8           mov         dword ptr [ebp-8],eax
  00401064: 81 7D FC FF 00 00  cmp         dword ptr [ebp-4],0FFh
            00
  0040106B: 7C B3              jl          00401020
  0040106D: EB 9A              jmp         00401009
  0040106F: 8B E5              mov         esp,ebp
  00401071: 5D                 pop         ebp
  00401072: C3                 ret
_wsprintfA:
  00401073: FF 25 04 20 40 00  jmp         dword ptr [__imp__wsprintfA]
_MessageBoxA@16:
  00401079: FF 25 00 20 40 00  jmp         dword ptr [__imp__MessageBoxA@16]

  Summary

        1000 .rdata
        1000 .reloc
        1000 .text

EDIT

The screen shot seems to be inlined after I posted the answer and the code in screen shot belongs to ntdll.dll and not your module. ntdll is a dll that is mandatory for any application and it provides the low level resources and routines for transitioning into kernel space.

Go to modules pane (Alt+m I would guess as x64dbg uses ollydbg ui shorcuts ) and select your module and follow its entry point to look at your code.