2
Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.
2
From type == 0 you see that it writes to param_3 and reads from param_4. So those parameters must be pointers to output and input buffers respectively. In fact, if you change them to correct type (byte *), then I believe Ghidra should be able to simplify the rest of the code to easily understandable form.
The part that modifies param_2 is a simple pseudo-...
1
0x405044 is the address of your format string. You can print the string with x/s 0x405044 It stores this address at esp cause its your first argument.
1
Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers:
OllyDbg
Immunity Debugger
IDA Pro/Freeware
WinDbg
x64dbg
It seems Visual Studio is not supported but you can always do it the manual way:
Patch an infinite loop (EB FE) at the current EIP/RIP;
Detach the current debugger. ...
Only top voted, non community-wiki answers of a minimum length are eligible
Related Tags
disassembly × 1080ida × 291
assembly × 210
x86 × 111
binary-analysis × 90
windows × 80
decompilation × 73
c × 64
arm × 61
c++ × 60
debugging × 58
disassemblers × 46
radare2 × 45
ollydbg × 41
firmware × 41
static-analysis × 41
malware × 36
ghidra × 36
gdb × 30
linux × 28
idapython × 24
elf × 24
debuggers × 24
pe × 23
x86-64 × 23