3

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below.

for ( i = 0; i < 6; ++i )
{
  v7 = (int)&val_253;                         
  for ( k = 1; k < key[i]; ++k )
    v7 = *(_DWORD *)(v7 + 8);
  v4[i] = v7;
}

I can't understand what is happening in v7 = *(_DWORD *)(v7 + 8); line. After executing this line the value of v7 changes from 0xC. I can't understand how it happens. I thought the value should change from 0x8.

And I thought *(_DWORD *) should return a value. But instead, it returns another pointer. How is that happened (The both values of the memory, 0xc away from &val_253 and 0x8 away from &val_253 are zero).

  • Hi, not sure I fully understand your question. Maybe this will help stackoverflow.com/questions/2995251/… & msdn.microsoft.com/en-us/library/cc230318.aspx – Hackndo Jul 31 '15 at 7:23
  • If someone can tell me what is happening in v7 = *(_DWORD *)(v7 + 8); codeline, it may resolve half of my problems.. – Ramesh-X Jul 31 '15 at 7:48
  • *(DWORD *) = DWORD [ADDRESS] = 0x13371337 *(char *) = BYTE [ADDRES] = 0x7b *(sometype *) = SOMETYPE [ADDRESS] = 0x1234567890123456badf00d – blabb Jul 31 '15 at 8:41
  • For starters this is C pseudo code - not disassembly as the tag suggests - and if you used IDA you likely used the Hex-Rays decompiler plugin. So thinking this through: you spend several thousand dollars or euros for something of which you seem to know little? It may solve half of your problems if you pick up a C book below a hundred dollars and learn to understand the target language of the decompiler plugin. – 0xC0000022L Aug 1 '15 at 12:57
  • I know this is pseudocode. There is no tag called pseudocode here and I can't create one because I have low reputation. So I tagged disassembly so someone will see this. Here I did a mistake. The value of the memory 0x8 away from &val_253 is not zero. It points to another memory location which is located 0xC away from &val_253. I didn't see that before. Though I thought *(_DWORD *) should return a value, it returns a pointer. That's why after executing value of v7 changes from 0xC – Ramesh-X Aug 1 '15 at 13:41
5
v7 = *(_DWORD *)(v7 + 8);

Means :

v7 = *(v7 + 8)

Or in assembly

MOV v7, DWORD PTR [v7 + 0x8]

(This is only for understanding purpose, chances are that it's not really like above samples)

v7 is assigned with the value located at address v7+8*sizeof(DWORD). For example, if v7 = 0xabcd0123 then v7 + 8*sizeof(DWORD) = 0xabcd0143. Whatever is located at 0xabcd0143 will be assigned to v7.

  • 1
    Wrong. v7 won't be egal to 0xabcd012b, but 0xabcd0143 (in other words, 0xabcd0123 + sizeof(DWORD)*8). If you prefer, v7 = *(v7 + 8) <=> v7 = v7[8]. – Spl3en Jul 31 '15 at 10:58
  • Uhm ... "means, in C code"? Some how implying that it's not already C ... which it is ...?! – 0xC0000022L Aug 1 '15 at 12:55
  • Fixed. Silly mistakes :) – Hackndo Aug 4 '15 at 6:37
  • So in summary this means read the contents of the 8th DWORD located after the address v7 is currently pointing to? How does it know how many bytes to read? does it read a single DWORD in this case? or does it depend on the type declared for v7? – Roberto Andrade Nov 6 '15 at 12:11
  • No, it means "Move the DWORD located at v7+0x8, and put it in v7" – Hackndo Nov 9 '15 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.