So I made a very simple C program to study how C works on the inside. It has just 1 line in the main() excluding return 0:


If I use ollydebugger to analyze this program It will show something like this(text after the semicolons are comments generated by ollydebugger.

MOV DWORD PTR SS:[ESP],test_1.004030EC     ; ||ASCII "cls"
CALL <JMP.&msvcrt.system>                ; |\system

Can someone explain what this means, and if I want to change the "cls" called in the system() to another command, where is the "cls" stored? And how do I modify it?

  • Ascii string cls is stored at virtual address 004030EC. In Olly press ,Ctrl + G to go there. – 0xec Jul 11 '15 at 15:04

The Ascii string cls is stored at address 0x004030EC. Why is it stored at that location is probably compiler related.

The ESP register holds the address of the top of the stack. What your instruction

MOV DWORD PTR SS:[ESP],test_1.004030EC     ; ||ASCII "cls"

means is to put the value 0x004030EC to the address pointed to by ESP. If the value of ESP is, lets say, ESP = 0x0018FF8C, then the value at address 0x0018FF8C will be 0x004030EC after the above MOV instruction is executed.

If you want to change the string cls to something else, you can position at the dump window in Olly and press CTRL-G. A popup box will appear and there you will enter 0x004030EC and press Ok. After that right click on the first byte at that address, which should be 0x63 (the letter 'c' from string "cls") and choose Binary -> Edit. There you can enter your new string that will be passed to the CALL instruction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.