3

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps :

When loaded in Ollydbg it pauses at:

00401000 > $  8D9404 7713210>LEA EDX,DWORD PTR SS:[ESP+EAX+0x211377]
00401007   . /E9 CF020000    JMP setup.004012DB 

then :

004012DB   > \BA 0C000000    MOV EDX,0xC
004012E0   .  8B4C24 1C      MOV ECX,DWORD PTR SS:[ESP+0x1C]
004012E4   .  41             INC ECX
004012E5   .  09C9           OR ECX,ECX
004012E7   .  75 0C          JNZ SHORT setup.004012F5
004012E9   .  0F2ECF         UCOMISS XMM1,XMM7
004012EC   .  74 13          JE SHORT setup.00401301

and :

00401301   >  89E5           MOV EBP,ESP
00401303   .  C3             RETN

then it exits :

7C81776F    50               PUSH EAX
7C817770    E8 8349FFFF      CALL kernel32.ExitThread

What exactly happens here , I guess it has to do with the line UCOMISS XMM1,XMM7 but I have no clue what it does ?

1
  • 3
    According to the Intel assembly manual, that instruction is UCOMISS -- Unordered Compare Scalar Single-Precision Floating-Point Values and Set EFLAGS. A better question would be what values are in XMM registers at that point and why.
    – DCoder
    Commented Feb 28, 2014 at 20:45

1 Answer 1

1

the jnz at 4012e7' should be taken if 401000 is PeHeader->EntryPoint

your post indicates that it has not been taken invesitage who messed up with SEH CHAIN

esp+1c normally holds EndOfSehChain (0xffffffff) when broken on EntryPoint see SehProlog() in Kernel32!BaseProcessStart()

cdb -c "bp calc+@@c++(( (ntdll!_IMAGE_NT_HEADERS *)  @@masm(calc+by(calc+3c)))->OptionalHeader.AddressOfEntryPoint);g;!exchain;dd @esp+1c l2;q" calc

output

Breakpoint 0 hit
0007ffe0: kernel32!_except_handler3+0 (7c839ad8)
  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c8438ea)
                func:   kernel32!BaseProcessStart+3a (7c843900)
Invalid exception stack at ffffffff
0007ffe0  ffffffff 7c839ad8
quit:

debugger does not mess with this value

sample code to check (esp+1c) at EP

ucomisstest>type ucomisstest.cpp
#include <stdio.h>
char strin[] = { "hello baby\n" };
char strun[] = { "hello babie\n" };
char stron[] = { "hello barbie\n" };
int main (void)    {
    __asm {    mov ecx, dword ptr ds:[esp+1ch]
               inc ecx    or ecx,ecx
            jnz noseh
            ucomiss xmm1,xmm7
            je exit
            lea eax, strun
            push eax
            call printf
            pop eax
exit:
        lea eax, strin
            push eax
            call printf
            pop eax
noseh:
        lea eax, stron
            push eax
            call printf
            pop eax
    } return 0;    }    
\ucomisstest>cl /nologo ucomisstest.cpp
ucomisstest.cpp    
\ucomisstest>ucomisstest.exe
hello barbie 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.