0

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for:

call   0x00408b6d <---

test   al,al 

je     0x0040109f 

lea    eax,[esp+0x20] <---

First of all, what is at the memory address the call instruction is at? Second, what is the leave instruction do?

cmp    BYTE PTR [esp+0x12],0x0 <---
mov    eax,DWORD PTR [esp+0x20]
mov    DWORD PTR [esp+0x1c],eax

Third, how does the compare instruction make sense?

Last, what does this do?

rep movs DWORD PTR es:[edi],DWORD PTR ds:[esi]

Also, how I can tell if this file is statically or dynamically linked? I mean, when executed, if it's statically linked it must've been compiled that way. If dynamic there must be other program running. Basically, this is suppose to be the first executable on boot of a PE.

Improve this question
4
  • 1
    You might consider getting more familiar with reverse engineering of x86 user-mode software before digging into bootloaders.
    – Jonathon Reinhart
    Apr 25, 2014 at 23:01
  • REP commands are always a type of loop that copies everything from one thing to another thing. like memcpy I usually use IDA PRO to figure out what each assembly instruction does. NOP alot of code at some address in some application and assemble which ASM you want to figure out then Press F5 and see what the code translates too in C for IDA PRO.
    – SSpoke
    Apr 26, 2014 at 1:49
  • winload.exe is NOT the first PE. bootmgr.exe is the first PE to run in the boot process of Windows NT6. See www.nvlabs.in/uploads/projects/vbootkit/nitin_vipin_vista_vbootkit.ppt . bootmgr.exe is embedded inside the file bootmgr that you can find on your system partition.
    – Milind R
    Sep 17, 2014 at 6:44
  • @JonathonReinhart I think bootloaders are easier for people without much professional programming experience : they are simpler and not threaded.
    – Milind R
    Sep 17, 2014 at 6:46

1 Answer 1

Reset to default
3

The call instruction is nothing but a fancy jump to a location in the code. Usually, it's a basic block ending with a ret instruction, namely a function. So at the address 0x00408b6d, you'll find a function.

The lea instruction has nothing to do with the leave instruction. lea stands for 'load from effective address' meaning that the eax register will contain the value pointed out by the address in esp+0x20.

If you want to understand what's going on with the cmp and rep you should check these two links : cmp, rep. The explanations are clear and you'll know what flags are set and what happens when an instruction is executed.

For the remaining part I just couldn't guess what you tried to say and I prefer to ask you to provide more clarifications if possible.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.