Geek Answers Handbook

Help decrypting multiple assembly lines

I found these few assembly lines in ollydbg:

MOV ECX,DWORD PTR DS:[xxxxxxxx] ; xxxxxxxx is an address
MOV EDX,DWORD PTR DS:[ECX]
MOV EAX,DWORD PTR DS:[EDX+116]
CALL EAX

Can someone come in and tell me what's going on here?

+5
source share
4 answers

This is a function pointer call stored in a structure.

This first line gets the pointer stored at the address DS:xxxxxxxx. The square brackets indicate the dereferencing of the address, as *in C. A value from memory should be used as a pointer; It is placed in the register ecx.

MOV ECX,DWORD PTR DS:[xxxxxxxx] ; xxxxxxxx is an address

, . ecx , . , , . edx.

MOV EDX,DWORD PTR DS:[ECX]

; 0x116 . , ++ vtable. , , eax.

MOV EAX,DWORD PTR DS:[EDX+116]

, , eax. . , , , : PUSH, ? . , , .

CALL EAX

, OllyDbg. ABI OllyDbg struct, . , , edx -held pointer ( ), , struct, vtable ++.

, xxxxxxxx struct, .

OllyDbg PlugIn.h - struct. :

typedef struct t_sorted {              // Descriptor of sorted table
  char           name[MAX_PATH];       // Name of table, as appears in error
  int            n;                    // Actual number of entries
  int            nmax;                 // Maximal number of entries
  int            selected;             // Index of selected entry or -1
  ulong          seladdr;              // Base address of selected entry
  int            itemsize;             // Size of single entry
  ulong          version;              // Unique version of table
  void           *data;                // Entries, sorted by address
  SORTFUNC       *sortfunc;            // Function which sorts data or NULL
  DESTFUNC       *destfunc;            // Destructor function or NULL
  int            sort;                 // Sorting criterium (column)
  int            sorted;               // Whether indexes are sorted
  int            *index;               // Indexes, sorted by criterium
  int            suppresserr;          // Suppress multiple overflow errors
} t_sorted;

NULL, asm NULL . , DRAWFUNC t_table SPECFUNC t_dump.

, , printf() offsetof(), , 0x116.

, OllyDbg . , , struct ( Plugin.h), OllyDbg.

, , , OllyDbg . , , , - GPL, OllyDbg.

+6

32- xxxxxxx ECX, EDX, 116 EAX. , EAX. , .

. , , ; -)

+2

, ASM (1997), i386 ASM, , ...

, 4 . .

, , , CX. CX DX. , CX, DX. DX 116 AX ( ?)

, , AX.

0

99% , , , MSVC.

MOV ECX,DWORD PTR DS:[xxxxxxxx]

ECX . (NB: __thiscall ECX , this).

MOV EDX,DWORD PTR DS:[ECX]

vftable ( ) . EDX.

MOV EAX,DWORD PTR DS:[EDX+116]

116 (0x74) EAX. 4 , 30- (116/4 + 1).

CALL EAX

.

++ :

g_pObject1->method30();

++ MSVC, , . .

0
source

More articles:


All Articles