I see a lot of in and out instruction in IDA. I know what those are supposed to do, but I do not know how to treat them and I'm making no advancements in understanding the code.
Short example: First instructions of my current assignment are:
seg000:00000000 mov edx, 61666A1Fh seg000:00000005 fincstp seg000:00000007 fnstenv byte ptr [esp-0Ch] seg000:0000000B pop esi ; EIP seg000:0000000C sub ecx, ecx seg000:0000000E mov cl, 33h ; '3' seg000:00000010 xor [esi+12h], edx seg000:00000013 add edx, [esi+12h] ; seg000:00000016 xor ecx, 0FFFFFF96h seg000:00000019 test [ecx+esi*8+957C08Fh], dl seg000:00000020 push eax ; ?????? seg000:00000021 mov bl, 0DEh ; '¦' seg000:00000023 in al, dx seg000:00000024 popa seg000:00000025 loope near ptr 0FFFFFFACh
I'm a bit lost at
0Bh as it's the first time I encounter FPU instructions, but I think that
ESI should point to the where
EIP is pointing to.
My main question is regarding
in al, dx
Should load a in
AL a byte from port
6A1Fh? Is this relevant in any way or is code like this supposed to make my work harder or hide something? Maybe it's encrypted and at some point some decrypting algorithm will kick in. Or maybe that shouldn't be viewed as code?