I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ; DllMain entry point
mov ebp, esp
add esp, FFFFFFBC
xor eax, eax
mov dword ptr ss:[ebp-44], eax
mov eax, module.8BC3980
call module.8BB8D54
xor eax, eax
Wikipedia says the following about function prologues:
A function prologue typically does the following actions if the architecture has a base pointer (also known as frame pointer) and a stack pointer:
Pushes current base pointer onto the stack, so it can be restored later.
Assigns the value of stack pointer (which is pointed to the saved base pointer) to base pointer so that a new stack frame will be created on top of the old stack frame.
Moves the stack pointer further by decreasing or increasing its value, depending on whether the stack grows down or up. On x86, the stack pointer is decreased to make room for the function's local variables.
[...]
As an example, here′s a typical x86 assembly language function prologue as produced by the GCC
push ebp mov ebp, esp sub esp, N
But I have encountered an add esp, N
directive which adds a huge number to esp
register. It seems something is wrong here, what should I understand from the code exactly?
And the second question is about mov dword ptr ss:[ebp-44], eax
directive. Why it is 44 that is subtracted from ebp
address (11 ints!) and what does the ss
item here?
PS I suspect that the DLL is written in Delphi, but not 100% sure.
FFFFFFBC
is equal to subtracting68
as the value will wrap around.FFFFFFBC + 0x44 = 0
when we are dealing with dwords.