0

As I am working on malware analysis, I got stuck in a place where I have to change the given set of assembly-level instructions to high-level code. Example:

Assembly Level Code

mov ebp, esp       

and eax,0

High-Level Code

r_ebp_1 = r_esp_1 

r_eax_1 = r_eax_1 & 0x0

Though I have searched on the internet, I couldn't get the solution I am searching for. Could someone please help me to find the answer?

Improve this question
4
  • 1
    Is this homework? If so, presumably your instructor gave you some directions in this regard in the earlier material...?
    – Rolf Rolles
    Oct 8, 2022 at 21:43
  • 1
    One thing to keep in mind is that there likely will not be a 1:1 mapping of assembly to higher level language instructions. You need to understand what the assembly instructions are doing, then write the equivalent HL code. Don't try to translate each line of assembly.
    – Mega Tonnage
    Oct 9, 2022 at 5:01
  • Dear @RolfRolles, as I told I'm working on malware analysis, for doing in dept analysis I suppose to do this
    – okokok hack
    Oct 9, 2022 at 5:23
  • 1
    It is just like asking to convert my jet to a car that too among various kind of cars and without even knowing which kind of car. Please note that to become a satellite one need to left ground, that is the expected path. Going down, you need to be clear on various parameters (read as requirements).
    – AKS
    Dec 20, 2022 at 13:58

2 Answers 2

Reset to default
2

Assemble Level Code

mov ebp, esp

and eax,0

Since the code is incomplete, I would venture to guess that this is part of a function and that the function returns a value in the eax register. Thus, based on the truth table of the logical operation AND - whatever is in eax - it will be set to zero.

High-Level Code

return 0;

Improve this answer
1

For the solution of your trivial example, see the answer of @rce.

However, achieving a proper understanding of a more realistc, fairly complex assembler code and convert it into HL-code, you should be sure that your reversing produced not only understandable, but also correct HL-code.

"Correct" means here that the original assembler code and the HL-code produce the same results, which you can verify e.g. by letting them run in two instances of IdaPro, each with the debugger running, and comparing after each significant step for correctness.

You could proceed like so:

  1. Convert the assembler code in "Assembler-like" C code, just as you did it in your question.

  2. Simplify it. Try to get rid of constructs specific for the assembler version and convert it into a more "C" natural form. This is what @rce did in his answer.

  3. Try to understand the logic behind the constructs. Change the "register-like" variable names to "speaking" names connected to the logical meaning of the code. This is not possible from your example as you only provide two(!) lines of assembly code.

  4. Re-write the whole thing step-by-step in logical terms only.

  5. Always compare whether the output is correct. Even if steps 1 to 4 could be realized differently, this step is indispensible.

As this seems tedious, for more complex algorithms (which cannot be recognized by other means like the use of known "magic numbers"), this can be a successful strategy for a proper reverse engineering of non-trivial assembler code. It can become difficult, e.g. if you have "flattened" code or algorithms which contain vectorized code realized with intrinsics.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.