1

Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do?

mov     [ebp+var_4], 0FFFFFFFFh

This is WinMain used C++. I used try/catch.

.text:00411260                 push    ebp
.text:00411261                 mov     ebp, esp
.text:00411263                 push    0FFFFFFFFh
.text:00411265                 push    offset unk_414FC8
.text:0041126A                 push    offset loc_411050
.text:0041126F                 mov     eax, large fs:0
.text:00411275                 push    eax
.text:00411276                 mov     large fs:0, esp
.text:0041127D                 add     esp, 0FFFFFFA0h
.text:00411280                 push    ebx
.text:00411281                 push    esi             ; uType
.text:00411282                 push    edi             ; uType
.text:00411283                 mov     [ebp+var_18], esp
.text:00411286                 mov     [ebp+var_1C], 64h
.text:0041128D                 mov     [ebp+var_20], 96h
.text:00411294                 mov     [ebp+var_4], 0
.text:0041129B                 mov     eax, [ebp+var_1C]
.text:0041129E                 add     eax, [ebp+var_20]
.text:004112A1                 mov     [ebp+var_24], eax
.text:004112A4                 int     3               ; Trap to Debugger
.text:004112A5                 mov     [ebp+var_4], 0FFFFFFFFh
.text:004112AC                 jmp     short loc_4112D2
.text:004112AE ; ---------------------------------------------------------------------------
.text:004112AE                 mov     eax, 1
.text:004112B3                 retn
.text:004112B4 ; ---------------------------------------------------------------------------
.text:004112B4                 mov     esp, [ebp-18h]
.text:004112B7                 push    0
.text:004112B9                 push    offset Caption  ; "Error1"
.text:004112BE                 push    offset Caption  ; "Error1"
.text:004112C3                 push    0               ; hWnd
.text:004112C5                 call    ds:__imp__MessageBoxA@16 ; MessageBoxA(x,x,x,x)
.text:004112CB                 mov     [ebp+var_4], 0FFFFFFFFh
.text:004112D2
.text:004112D2 loc_4112D2:                             ; CODE XREF: WinMain+4Cj
.text:004112D2                 mov     [ebp+var_28], 64h
.text:004112D9                 mov     [ebp+var_2C], 96h
.text:004112E0                 mov     [ebp+var_4], 1
.text:004112E7                 mov     eax, [ebp+var_28]
.text:004112EA                 add     eax, [ebp+var_2C]
.text:004112ED                 mov     [ebp+var_30], eax
.text:004112F0                 mov     eax, [ebp+var_30]
.text:004112F3                 cdq
.text:004112F4                 xor     ecx, ecx
.text:004112F6                 idiv    ecx
.text:004112F8                 mov     [ebp+var_30], eax
.text:004112FB                 mov     [ebp+var_4], 0FFFFFFFFh
.text:00411302                 jmp     short loc_411328
.text:00411304 ; ---------------------------------------------------------------------------
.text:00411304                 mov     eax, 1
.text:00411309                 retn
.text:0041130A ; ---------------------------------------------------------------------------
.text:0041130A                 mov     esp, [ebp-18h]
.text:0041130D                 push    0
.text:0041130F                 push    offset Text     ; "Error2"
.text:00411314                 push    offset Text     ; "Error2"
.text:00411319                 push    0               ; hWnd
.text:0041131B                 call    ds:__imp__MessageBoxA@16 ; MessageBoxA(x,x,x,x)
.text:00411321                 mov     [ebp+var_4], 0FFFFFFFFh
.text:00411328
.text:00411328 loc_411328:                             ; CODE XREF: WinMain+A2j
.text:00411328                 xor     eax, eax
.text:0041132A                 mov     ecx, [ebp+var_10]
.text:0041132D                 mov     large fs:0, ecx
.text:00411334                 pop     edi
.text:00411335                 pop     esi
.text:00411336                 pop     ebx
.text:00411337                 mov     esp, ebp
.text:00411339                 pop     ebp
.text:0041133A                 retn    10h
.text:0041133A WinMain         endp
| improve this question | |
4

In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block).

The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks).

For more info check my OpenRCE article.

| improve this answer | |
  • I know a bit about SEH and EXCEPTION_REGISTRATION structures. Yes, I used C++ __try for this code. Looked at your article, very interesting, so, usage var_4 variable is to marks position of __try blocks in program binary code? – black4 May 29 at 15:27
  • Additionally I am interesting, what is this line of code doing: text:00411265 push offset unk_414FC8 this line of code has stub FFFFFFFF and points to exit: text:004112AE mov eax, 1 .text:004112B3 retn This line of code is part of SEH, too? Or what? – black4 May 30 at 16:38
  • 1
    The first lines set up the SEH handler for the function and the other snippet is the __except() filter code. – Igor Skochinsky♦ May 30 at 16:51
  • I thought SEH handler is .text:0041126A push offset loc_411050. what difference between .text:00411265 push offset unk_414FC8 and .text:0041126A push offset loc_411050? It are both SEH handlers? But this function is not present in SEH chain .text:00411265 push offset unk_414FC8. SEH chain started in .text:0041126A push offset loc_411050 and not contains unk_414FC8. I am a bit confused, explain please. – black4 May 31 at 15:39
  • 1
    Check Appendix I in the article – Igor Skochinsky♦ May 31 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.