3

i have the following assembly lines:

....
LEA   EAX, DWORD PTR DS:[0x404212]
MOV   DWORD PTR SS:[EBP-0x3CC], EAX
PUSH  DWORD PTR SS:[EBP-0x3CC]
...
...
...
LEA   EAX, DWORD PTR DS:[0x404213]
MOV   DWORD PTR SS:[EBP-0x3D0], EAX
PUSH  DWORD PTR SS:[EBP-0x3D0]
...
...

So, I asked myself how I can that piece of code translate into a higher language like C? Or a pseudo C language?

But, for the the two blocks I have the following:

 UNKNOWNTYPE *eax_pointer_1;     //points to 00404212
 UNKNOWNTYPE *eax_pointer_2;     //points to 00404213

In ollydbg, I see that at the address 00404212 there is the following line :

ADD BYTE PTR DS:[EAX], DH

and at the address 00404213, there is:

XOR BYTE PTR DS:[EAX], AL

So my question would be : Is that a correct transformation? Have you some ideas how I can the instructions at 00404212 and 00404213 make part of my transformation into a pseudo-C language?

2
  • 1
    If you are sure these pointers point to a function (and not data), then your UNKNOWNTYPE * is a function pointer. To "make them part" of the entire code, convert the pointed-to instructions to a separate function as well.
    – Jongware
    Aug 30, 2014 at 14:37
  • ok, thx for your answer. Aug 30, 2014 at 18:34

2 Answers 2

2

In ollydbg, I see that at the address 00404212 there is the following line:

ADD BYTE PTR DS:[EAX], DH

And, at the address 00404213, there is:

XOR BYTE PTR DS:[EAX], AL

I dont think those are code, rather variables, are they in a code/execute section ?

3
  • No, they are not in a code/execute section. I only jump to that two addresses´ by right-clicking in ollydbg and then "Go To -> Expression" Aug 31, 2014 at 23:13
  • Well, that invalidates my earlier comment. Examine the data at that point to guess the type of the pointer.
    – Jongware
    Sep 1, 2014 at 6:33
  • these two lines are data segment where arguments are pointing to, its abslutly useless to translate em into asm instructions !
    – Abr001am
    Sep 4, 2015 at 4:47
1

It looks like the address of something (maybe an array element) is being taken and that is being used to set up call frame for later use. Something very roughly like:

void f(void){
  void *x = &someMemory;
  void *y = &someMemory2;

  g(y,x);
}

caveat lector.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.