3

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below.

for ( i = 0; i < 6; ++i )
{
  v7 = (int)&val_253;                         
  for ( k = 1; k < key[i]; ++k )
    v7 = *(_DWORD *)(v7 + 8);
  v4[i] = v7;
}

I can't understand what is happening in v7 = *(_DWORD *)(v7 + 8); line. After executing this line the value of v7 changes from 0xC. I can't understand how it happens. I thought the value should change from 0x8.

And I thought *(_DWORD *) should return a value. But instead, it returns another pointer. How is that happened (The both values of the memory, 0xc away from &val_253 and 0x8 away from &val_253 are zero).

Improve this question
5
  • Hi, not sure I fully understand your question. Maybe this will help stackoverflow.com/questions/2995251/… & msdn.microsoft.com/en-us/library/cc230318.aspx
    – Hackndo
    Jul 31, 2015 at 7:23
  • If someone can tell me what is happening in v7 = *(_DWORD *)(v7 + 8); codeline, it may resolve half of my problems..
    – Ramesh-X
    Jul 31, 2015 at 7:48
  • *(DWORD *) = DWORD [ADDRESS] = 0x13371337 *(char *) = BYTE [ADDRES] = 0x7b *(sometype *) = SOMETYPE [ADDRESS] = 0x1234567890123456badf00d
    – blabb
    Jul 31, 2015 at 8:41
  • For starters this is C pseudo code - not disassembly as the tag suggests - and if you used IDA you likely used the Hex-Rays decompiler plugin. So thinking this through: you spend several thousand dollars or euros for something of which you seem to know little? It may solve half of your problems if you pick up a C book below a hundred dollars and learn to understand the target language of the decompiler plugin.
    – 0xC0000022L ♦
    Aug 1, 2015 at 12:57
  • I know this is pseudocode. There is no tag called pseudocode here and I can't create one because I have low reputation. So I tagged disassembly so someone will see this. Here I did a mistake. The value of the memory 0x8 away from &val_253 is not zero. It points to another memory location which is located 0xC away from &val_253. I didn't see that before. Though I thought *(_DWORD *) should return a value, it returns a pointer. That's why after executing value of v7 changes from 0xC
    – Ramesh-X
    Aug 1, 2015 at 13:41

1 Answer 1

Reset to default
7 
v7 = *(_DWORD *)(v7 + 8);

Means :

v7 = *(v7 + 8)

Or in assembly 

MOV v7, DWORD PTR [v7 + 0x8]

(This is only for understanding purpose, chances are that it's not really like above samples)

v7 is assigned with the value located at address v7+8*sizeof(DWORD). For example, if v7 = 0xabcd0123 then v7 + 8*sizeof(DWORD) = 0xabcd0143. Whatever is located at 0xabcd0143 will be assigned to v7.

Improve this answer
5
  • 1
    Wrong. v7 won't be egal to 0xabcd012b, but 0xabcd0143 (in other words, 0xabcd0123 + sizeof(DWORD)*8). If you prefer, v7 = *(v7 + 8) <=> v7 = v7[8].
    – Spl3en
    Jul 31, 2015 at 10:58
  • Uhm ... "means, in C code"? Some how implying that it's not already C ... which it is ...?!
    – 0xC0000022L ♦
    Aug 1, 2015 at 12:55
  • Fixed. Silly mistakes :)
    – Hackndo
    Aug 4, 2015 at 6:37
  • So in summary this means read the contents of the 8th DWORD located after the address v7 is currently pointing to? How does it know how many bytes to read? does it read a single DWORD in this case? or does it depend on the type declared for v7?
    – Roberto Andrade
    Nov 6, 2015 at 12:11
  • No, it means "Move the DWORD located at v7+0x8, and put it in v7"
    – Hackndo
    Nov 9, 2015 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.