I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ?
Also,I was debugging an exe which has PTRD at 0x600 and AEP at 0x1000 (same as PTRD) but at offset 0x400 I see some instructions which I have seen in some other files too. In my sample it is unreachable code,but in one test exe which I wrote using WINASM/MASM it was same sequence of instructions just had a bit more instruction .If I change the AEP to 400 the assembly is as follows:
00400400 6A 00 PUSH 0 00400402 68 05304000 PUSH 00403005 00400407 68 00304000 PUSH 00403000 0040040C 6A 00 PUSH 0 0040040E E8 17040000 CALL 0040082A 00400413 6A 00 PUSH 0 00400415 E8 16040000 CALL 00400830 0040041A E8 17040000 CALL 00400836 0040041F E8 1E040000 CALL 00400842 00400424 E8 13040000 CALL 0040083C 00400429 C3 RETN
I wrote a Hello world program in MASM which had AEP at 0x1000 the code seems similar but I can debug it i.e it is not unreachable/dead code like previous one.It is as follows:
00401000 6A 00 PUSH 0 00401002 68 00304000 PUSH OFFSET 00403000 00401007 68 06304000 PUSH OFFSET 00403006 0040100C 6A 00 PUSH 0 0040100E E8 0D000000 CALL <JMP.&user32.MessageBoxA> 00401013 A3 14304000 MOV DWORD PTR DS:,EAX 00401018 33C0 XOR EAX,EAX 0040101A 50 PUSH EAX 0040101B E8 06000000 CALL <JMP.&kernel32.ExitProcess> 00401020 FF25 08204000 JMP DWORD PTR DS:[<&user32.MessageBoxA>] 00401026 FF25 00204000 JMP DWORD PTR DS:[<&kernel32.ExitProcess
So my question is how come code is coming in my sample at offset 0x400,what is the use of this code ,is there some compiler which is putting it out there?
Note:Its a virus sample and I am a starter.Thanks for the answers in advance...