1

In Visual Studio I have written simple code,

int pranit = 2;
int& sumit = pranit;

int main(int argc, char** argv) {
    sumit++;
    return sumit;
}

I used OllyDbg to Disassamble, but I am not able to find where sumit, pranit are defined in assembly. Though doing some string search I got following details:

Names in ConsoleA, item 313  Address=013B8004  Section=.data 
Type=Library  Name=sumit

Names in ConsoleA, item 257  Address=013B8000  Section=.data 
Type=Library  Name=pranit

How to find, where and how it is used in assembly code. Also, I want to find out both address and value of these global variables.

Improve this question
2
  • @blabb: I had Ollydbg on and opened an EXE in it, and also see what you mean by the comment column. I do not understand what you mean by "Tab the comment column" though - could you please explain? Secondly I could not find where the "Recognized args and locals" was in Ollydbg. Which version are you using? 1.10? 2.01? Other? Do specify. Lastly while your solution possibly works, I'd like to give a slightly different perspective too. Many times you wouldn't even have the .pdb file with you - in that case the variable names sumit and pranit would not show up at all IMO. You would only see s
    – LDE
    Commented Jan 16, 2014 at 16:42
  • Your "answer" looks like a comment to blabb answer... You should consider deleting it and resubmitting it as a comment to blabb answer.
    – perror
    Commented Jan 16, 2014 at 17:23

2 Answers 2

Reset to default
8

opening a vc commandprompt using 

start->programs->vc->vc command prompt

Setting environment for using Microsoft Visual Studio 2010 x86 tools. creating a tempdir in desktop for compiling and linking

C:\Program Files\Microsoft Visual Studio 10.0\VC>cd "c:\Documents and Settings\Admin\Desktop"
C:\Documents and Settings\Admin\Desktop>md pran
C:\Documents and Settings\Admin\Desktop>cd pran
C:\Documents and Settings\Admin\Desktop\pran>copy con prankasum.cpp
^Z
        1 file(s) copied.
C:\Documents and Settings\Admin\Desktop\pran>write prankasum.cpp    
C:\Documents and Settings\Admin\Desktop\pran>type prankasum.cpp
#include <stdio.h>
int pranit = 2;
int& sumit = pranit;
int main(int argc, char** argv)
{
sumit++;
return sumit;
}    
C:\Documents and Settings\Admin\Desktop\pran>dir /b
prankasum.cpp    
C:\Documents and Settings\Admin\Desktop\pran>cl /nologo /Zi prankasum.cpp /link /RELEASE
prankasum.cpp    
C:\Documents and Settings\Admin\Desktop\pran>dir /b
prankasum.cpp
prankasum.exe
prankasum.obj
prankasum.pdb
vc100.pdb

opening the exe in ollydbg and navigating to main
tab the comment column to show source and in debugging options ask ollydbg to use recogneized args and locals

C:\Documents and Settings\Admin\Desktop\pran> ollydbg prankasum.exe      
00401000  >PUSH    EBP                          ; {
00401001   MOV     EBP, ESP
00401003   MOV     EAX, DWORD PTR DS:[sumit]    ; sumit++;
00401008   MOV     ECX, DWORD PTR DS:[EAX]
0040100A   ADD     ECX, 1
0040100D   MOV     EDX, DWORD PTR DS:[sumit]
00401013   MOV     DWORD PTR DS:[EDX], ECX
00401015   MOV     EAX, DWORD PTR DS:[sumit]    ; return sumit;
0040101A   MOV     EAX, DWORD PTR DS:[EAX]
0040101C   POP     EBP                          ; }
0040101D   RETN

or in windbg

prankasum!main:
00401000 55              push    ebp
0:000> uf @eip
prankasum!main [c:\documents and settings\admin\desktop\pran\prankasum.cpp @ 5]:
    5 00401000 55              push    ebp
    5 00401001 8bec            mov     ebp,esp
    6 00401003 a104b04000      mov     eax,dword ptr [prankasum!sumit (0040b004)]
    6 00401008 8b08            mov     ecx,dword ptr [eax]
    6 0040100a 83c101          add     ecx,1
    6 0040100d 8b1504b04000    mov     edx,dword ptr [prankasum!sumit (0040b004)]
    6 00401013 890a            mov     dword ptr [edx],ecx
    7 00401015 a104b04000      mov     eax,dword ptr [prankasum!sumit (0040b004)]
    7 0040101a 8b00            mov     eax,dword ptr [eax]
    8 0040101c 5d              pop     ebp
    8 0040101d c3              ret
0:000> dv
           argc = 0n1  argv = 0x00033ba8
0:000> ?? sumit     int * 0x0040b000
0:000> ?? pranit    int 0n2
0:000> pct    0040101d c3              ret
0:000> ?? sumit    int * 0x0040b000
0:000> ?? pranit    int 0n3
0:000> x /t /v /q prankasum!sumit
prv global 0040b004    4 int * @!"prankasum!sumit" = 0x0040b000
0:000> x /t /v /q prankasum!pranit
prv global 0040b000    4 int @!"prankasum!pranit" = 0n3

update

explanation for tabbing through comment column

each mdi window in ollydbg has a bar in top it can be hidden or shown

right click -> appearance -> show bar / hide bar

each of the bars have columns and many of the colums can be configured to show different items in cpu window if you repeatedly click the comment column it will cycle through 

comment / profile/ and source

comment will show all the 

analysis comments / user comments

profile will show all the run trace / hittrace/ module and global profile statistics

for example this strcpy_s was called 50 times during crt initialisation

004019EC   |.  >|CALL    prankasu.strcpy_s           ;  50.

inside this call this loop was called ~2700 times

00403D45   /MOV     CL, BYTE PTR DS:[EAX]       ;  2787.
00403D47   |MOV     BYTE PTR DS:[ESI+EAX], CL   ;  2787.
00403D4A   |INC     EAX                         ;  2787.
00403D4B   |TEST    CL, CL                      ;  2787.
00403D4D   |JE      SHORT prankasu.00403D52     ;  2787.
00403D4F   |DEC     EDI                         ;  2737.
00403D50   \JNZ     SHORT prankasu.00403D45     ;  2737.
00403D52   TEST    EDI, EDI                     ;  50.

if you cycle through to source column

strcpy_s is from vc\crt\stdenvp.c:133.  _ERRCHECK(_tcscpy_s(*env, cchars, p));

see below

004019E9   |PUSH    ESI           ; _ERRCHECK(_tcscpy_s(*env, cchars, p));
004019EA   |PUSH    EBX
004019EB   |PUSH    EAX
004019EC   |CALL    prankasu.strcpy_s
004019F1   |ADD     ESP, 0C

loop is from vc\crt\tcscpy_s_inl

00403D41   MOV     ESI, EDX        ; while ((*p++ = *_SRC++) != 0 && --available > 0)
00403D43   SUB     ESI, EAX
00403D45   /MOV     CL, BYTE PTR DS:[EAX]
00403D47   |MOV     BYTE PTR DS:[ESI+EAX], CL
00403D4A   |INC     EAX
00403D4B   |TEST    CL, CL
00403D4D   |JE      SHORT prankasu.00403D52

cycling to comment back you see

004019E9   |.  56    |PUSH    ESI                         ; /Arg3 = 7C90DE6E
004019EA   |.  53    |PUSH    EBX                         ; |Arg2 = 00000000
004019EB   |.  50    |PUSH    EAX                         ; |Arg1 = 00000000
004019EC   |.  E8 1D>|CALL    prankasu.strcpy_s           ; \strcpy_s

options->debugging options->cpu->select show symbolic address will make XXXXXX [40xxxx] to be shown as 

xxxxxx [sumit]

options ->debugging options->analysis->select show args and locals in procedure will make all ebp+XX to arg.1 arg.2 and all ebp-XX to local.1 local.2 

both ollydbg 1.10 and 2.01 behave similarly

full or partial (stripped down )symbolic information in any acceptable format (map tds pdb dbg ) is **mandatory** **requirement**

Improve this answer
2

step over in in the visual studio debugger, then right-click->show disassembly and you will see the disassembly, including variable names and addresses.

Improve this answer
1
  • With an obligatory footnote: "where sumit, pranitare defined in assembly" -- they are not. They only appear in the debugger courtesy of added debug information (and a debugger that understands the debug format).
    – Jongware
    Commented Jan 16, 2014 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.