2

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:

push    ebp                          ; DllMain entry point
mov     ebp, esp
add     esp, FFFFFFBC
xor     eax, eax
mov     dword ptr ss:[ebp-44], eax
mov     eax, module.8BC3980
call    module.8BB8D54
xor     eax, eax

Wikipedia says the following about function prologues:

A function prologue typically does the following actions if the architecture has a base pointer (also known as frame pointer) and a stack pointer:

Pushes current base pointer onto the stack, so it can be restored later.

Assigns the value of stack pointer (which is pointed to the saved base pointer) to base pointer so that a new stack frame will be created on top of the old stack frame.

Moves the stack pointer further by decreasing or increasing its value, depending on whether the stack grows down or up. On x86, the stack pointer is decreased to make room for the function's local variables.

[...]

As an example, here′s a typical x86 assembly language function prologue as produced by the GCC

push   ebp
mov    ebp, esp
sub    esp, N

But I have encountered an add esp, N directive which adds a huge number to esp register. It seems something is wrong here, what should I understand from the code exactly?

And the second question is about mov dword ptr ss:[ebp-44], eax directive. Why it is 44 that is subtracted from ebp address (11 ints!) and what does the ss item here?

PS I suspect that the DLL is written in Delphi, but not 100% sure.

Improve this question
2
  • adding FFFFFFBC is equal to subtracting 68 as the value will wrap around. FFFFFFBC + 0x44 = 0 when we are dealing with dwords.
    – Paweł Łukasik
    Mar 21, 2020 at 1:46
  • So stack was enlarged to contain 11 dwords (ints), then eax = 0, then this zero is written to the top of the stack entirely as dword, right?
    – StaticZero
    Mar 21, 2020 at 8:22

2 Answers 2

Reset to default
4

The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function.

At this point, ESP=EBP-0x44. So, EBP-0x44 is essentially, [ESP]. It is equivalent to PUSH EAX, as a parameter for the CALL that comes next.

The ss: is a selector which indicates that the "base" of the mentioned address is on the stack. In a linear memory system it has no practical meaning.

Improve this answer
2
  • So eax=0 is pushed onto the stack, then 8BC3980 is loaded into eax and finally the call?
    – StaticZero
    Mar 22, 2020 at 11:09
  • 1
    Yes. Different compilers sometimes produce different or unusual calling conventions. EAX cannot be expected to stay the same after a call but your function does put a value in EAX before the call, therefore we can assume that EAX is one argument and the value on the stack is another one. Delphi may very well generate this unusual convention.
    – Yotamz
    Mar 22, 2020 at 12:44
1

you should normally take a pencil and paper and try solving it

ill use python here

>>> ebp = 0x1000
>>> esp = ebp
>>> esp = ( esp + 0xffffffbc )& 0xffffffff
>>> print(hex(esp),hex(ebp-0x44))
0xfbc 0xfbc
>>>

It will write 0 to the Address 0xfbc if ebp were 0x1000 to start with

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.