0

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.

push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov dword ptr [ebp-0Ch], 3
mov dword ptr [ebp-4], 0

loc_401022:
 cmp dword ptr [ebp-4], 3
 jge loc_40103D
 mov eax, [ebp-4]
 mov ecx, [ebp+eax*4-14h]
 mov [ebp-8], ecx
 mov edx, [ebp-4]
 add edx, 1
 mov [ebp-4], edx
 jmp loc_401022

loc_40103D:
 xor eax, eax
 mov esp, ebp
 pop ebp
 ret
4
  • Please, format your code (CTRL+K).
    – wisk
    Mar 20, 2019 at 17:45
  • 3
    "I really find it hard to convert it into pseudo code" - what are you finding hard about it? Mar 21, 2019 at 1:48
  • As @wisk mentioned you can convert all those [ebp-XX] into stack variables. Either Ctrl+K or individually by clicking on the instruction parameter and pressing K to make a local variable. You can also name them, e.g. [ebp-4] could be idx. The code will become much clearer.
    – zxxc
    Mar 24, 2019 at 16:12
  • @zxxc I was talking about the code in the post before it was edited. :)
    – wisk
    Mar 24, 2019 at 16:20

1 Answer 1

0

I'll only add you some comments to make it easier for you to solve it:

push ebp
mov ebp, esp

// Reserve space for local variables on the stack - in your case is array
sub esp, 14h
// Initialize local variables - local array
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov dword ptr [ebp-0Ch], 3
mov dword ptr [ebp-4], 0

// We have a loop here
loc_401022:
 cmp dword ptr [ebp-4], 3     // Index variable
 jge loc_40103D               // Exit from the loop

// Think what is happening here :-)
 mov eax, [ebp-4]
 mov ecx, [ebp+eax*4-14h]
 mov [ebp-8], ecx

// Update the index variable
 mov edx, [ebp-4]
 add edx, 1
 mov [ebp-4], edx
 jmp loc_401022

// Function ending
loc_40103D:
 xor eax, eax
 mov esp, ebp
 pop ebp
 ret

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.