I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ; DllMain entry point mov ebp, esp add esp, FFFFFFBC xor eax, eax mov dword ptr ss:[ebp-44], eax mov eax, module.8BC3980 call module.8BB8D54 xor eax, eax
Wikipedia says the following about function prologues:
A function prologue typically does the following actions if the architecture has a base pointer (also known as frame pointer) and a stack pointer:
Pushes current base pointer onto the stack, so it can be restored later.
Assigns the value of stack pointer (which is pointed to the saved base pointer) to base pointer so that a new stack frame will be created on top of the old stack frame.
Moves the stack pointer further by decreasing or increasing its value, depending on whether the stack grows down or up. On x86, the stack pointer is decreased to make room for the function's local variables.
As an example, here′s a typical x86 assembly language function prologue as produced by the GCC
push ebp mov ebp, esp sub esp, N
But I have encountered an
add esp, N directive which adds a huge number to
esp register. It seems something is wrong here, what should I understand from the code exactly?
And the second question is about
mov dword ptr ss:[ebp-44], eax directive. Why it is 44 that is subtracted from
ebp address (11 ints!) and what does the
ss item here?
PS I suspect that the DLL is written in Delphi, but not 100% sure.