1

I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and is clear to me what is actually going on there.

push ebp
mov ebp,esp
sub esp,10h

But my worries came when I saw one that looks like this below

mov edi,dword ptr [0E9A474h];
imul eax,dword ptr [edi+5AF4h],70h;
cmp dword ptr [ebp+eax-35DCh],0h;
je some_location

And the prologue for the function doesn't have any instruction like this

sub esp,10h

At least I could have known the size of the stack the function is using for local variable storage.

And additional question is:

  1. Is this a good programming as far as assembly language is a concern?
  2. Can there be any collision in memory between this function and another?
  3. Is it possible to know the limit of this function in the stack? Either the Size
  • 1. Unless you know it wasn't written by a compiler, I'm not sure what you mean 2. Why would there be a collision? 3. Why does there need to be any stack usage? Don't take it the wrong way, I just don't understand the questions. – multithr3at3d May 23 at 16:42
  • It was written by a compiler @multithr3at3d – Dexter's May 23 at 16:44
  • Why would there be a collision? Maybe if there's another function accessing data at an address in the range in which this other function is also doing the same, something like in a thread. – Dexter's May 23 at 16:46
  • So to try and make you understand @multithr3at3d, I am kind of trying to know the size of the stack this function is using and maybe also what's actually going on there with the code. I know is getting some value from the heap, stores multiply it and save the result in the eax register – Dexter's May 23 at 16:46
  • And later this value in the eax register is used together with the value in ebp and a constant value 35DCh to reach to a point in the stack, copy a value there and compare to that value. Yes i suspect maybe another function is responsible for setting this value or maybe within the program itself. But what exactly is setting this value in the stack for this other function to test it. I am really confuse here. Any idea i will greatly appreciate – Dexter's May 23 at 16:50
3

The function prologue (push ebp, etc.) is common in assembly, but not required. ebp is often used for local varible access, but can as well be used as a general purpose register, just like eax.

Assembly allows the code to manipulate stack pointer at any place and doesn't force it to follow any convention - as long as there are no exceptions, CPU will not care; it will simply execute the instructions pointed by eip register. It will not stop you from accessing (even modifying) other function's memory as long as your program has enough privileges to do that. I think this answers your first two questions.

Regarding your third question, in general, it is not possible. However, usually, you can look for the instructions modifying esp (like push, pop, etc.) and infer it from them. If you showed us the entire function, it would be easier to tell the size in this particular case.

In fact, the instructions you have shared with us don't seem to access local variables of this function or of any other either. I don't know what are the values stored in edi and ebp registers, but I guess they point to some dynamically allocated data on heap.

| improve this answer | |
  • thanks, yes it does clear thinks out for me. And also they do point to a dynamic data on the heap, very correct. – Dexter's May 23 at 17:00
  • I know now that i can't get the size of the stack since the function can actually access any location on the stack, just like that. thanks a lot, i will try to do the mathematics done here cmp dword ptr [ebp+eax-35DCh],0h; in the reserve and see if i can get the return address of the function setting it or maybe something that can help me find the function responsible for setting this value. Indeed you have help me. thanks – Dexter's May 23 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.