-1

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.

push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov dword ptr [ebp-0Ch], 3
mov dword ptr [ebp-4], 0

loc_401022:
 cmp dword ptr [ebp-4], 3
 jge loc_40103D
 mov eax, [ebp-4]
 mov ecx, [ebp+eax*4-14h]
 mov [ebp-8], ecx
 mov edx, [ebp-4]
 add edx, 1
 mov [ebp-4], edx
 jmp loc_401022

loc_40103D:
 xor eax, eax
 mov esp, ebp
 pop ebp
 ret
  • Please, format your code (CTRL+K). – wisk Mar 20 at 17:45
  • 3
    "I really find it hard to convert it into pseudo code" - what are you finding hard about it? – Bruce Abbott Mar 21 at 1:48
  • As @wisk mentioned you can convert all those [ebp-XX] into stack variables. Either Ctrl+K or individually by clicking on the instruction parameter and pressing K to make a local variable. You can also name them, e.g. [ebp-4] could be idx. The code will become much clearer. – zxxc Mar 24 at 16:12
  • @zxxc I was talking about the code in the post before it was edited. :) – wisk Mar 24 at 16:20
0

I'll only add you some comments to make it easier for you to solve it:

push ebp
mov ebp, esp

// Reserve space for local variables on the stack - in your case is array
sub esp, 14h
// Initialize local variables - local array
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov dword ptr [ebp-0Ch], 3
mov dword ptr [ebp-4], 0

// We have a loop here
loc_401022:
 cmp dword ptr [ebp-4], 3     // Index variable
 jge loc_40103D               // Exit from the loop

// Think what is happening here :-)
 mov eax, [ebp-4]
 mov ecx, [ebp+eax*4-14h]
 mov [ebp-8], ecx

// Update the index variable
 mov edx, [ebp-4]
 add edx, 1
 mov [ebp-4], edx
 jmp loc_401022

// Function ending
loc_40103D:
 xor eax, eax
 mov esp, ebp
 pop ebp
 ret

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.