So im working on an crackme and came across a couple of FPU loads and pops that confused me.
Address main 0040169E pops 80 bit value of 00000000_FED63690h from the FPU stack (ST0=4275451536.0000000000) to the CPU stack
but when put on the CPU stack its value is changed to
CPU Stack
Locked Value ASCII Comments
0028FB38 |D2000000 Ò
0028FB3C |41EFDAC6 ÆÚïA
Why?
Here is the code with some comments:
main 00401696 PUSH EAX EAX=FED63690
main 00401697 FILD QWORD PTR SS:[LOCAL.268] Loads the FED63690 as a 64 bit value so -> 00000000_FED63690
main 0040169A LEA ESP,[LOCAL.266] ESP=0028FB20 (loads address of string on stack), ST0=4275451536.0000000000 (which euals above number)
main 0040169E FSTP QWORD PTR SS:[LOCAL.260] POPS 80 bit value of ST0 onto program stack as 64 bit
LOCAL.260 is address 0028FB38
Stack now looks like:
CPU Stack
Locked Value ASCII Comments
0028FB38 |D2000000 Ò
0028FB3C |41EFDAC6 ÆÚïA
main 004016A4 FLD QWORD PTR SS:[LOCAL.260] Loads value onto FPU Stack so -> ST0=4275451536.0000000000 (Same as before)
main 004016AA FSTP QWORD PTR SS:[LOCAL.264] <%i> = -771751936. POPS 80 bit value of ST0 onto program stack as 64 bit
LOCAL.260 is address 0028FB28
Stack now looks like:
CPU Stack
Locked Value ASCII Comments
0028FB28 |D2000000 Ò
0028FB2C |41EFDAC6 ÆÚïA
main 004016AE MOV DWORD PTR SS:[LOCAL.265],00401469 Format => "%i"
main 004016B6 LEA EAX,[LOCAL.194]
main 004016BC MOV DWORD PTR SS:[LOCAL.266],EAX s => OFFSET LOCAL.194
main 004016BF CALL <JMP.&msvcrt.sprintf>
Result is:
s="-771751936"