| View previous topic :: View next topic |
| Author |
Message |
Dr.Disrespect
Grandmaster Cheater
![]() Reputation: 3
Joined: 17 Feb 2016
Posts: 526
|
 Posted: Tue Mar 01, 2016 6:53 pm Post subject: push push push... Need help, thanks. |
 |
|
Please take a look at the following code:
| Code: |
push 00
push [ebp-58]
|
I have read some tutorials, which says, if I understand correctly, "push" is used for pushing a register on to the stack (storing the value in a register), such as
but what does the above code mean? It is not a register that is being pushed.
Thanks a lot.
|
|
| Back to top |
|
 |
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Tue Mar 01, 2016 7:04 pm Post subject: |
|
|
It first pushes the static value zero.
Then it pushes the value contained at the address represented by EBP minus 0x58.
|
|
| Back to top |
|
|
Dr.Disrespect
Grandmaster Cheater
![]() Reputation: 3
Joined: 17 Feb 2016
Posts: 526
|
| Posted: Tue Mar 01, 2016 7:21 pm Post subject: |
|
|
| Zanzer wrote: | It first pushes the static value zero.
Then it pushes the value contained at the address represented by EBP minus 0x58. |
Thanks for the reply. But why is "00" needed to be pushed? If the value is known, why not just move 00 back to where it was?
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Tue Mar 01, 2016 9:42 pm Post subject: |
|
|
The function that is being called requires two parameters.
Whatever that function may be, it can perform all sorts of actions depending on what that value is.
However, the current process calling that function always wants it to perform the same action with a value of 0.
Lets say, for example, the function being called is a Math.Max function.
It takes two arguments and returns whichever one is greater.
Well, it can work against any two numbers that you send it.
However, the calling process only wants to make sure the dynamic value they have ([ebp-58]) is positive.
If it is negative, well then they just want to use the value of zero instead.
So, they ALWAYS pass the function a value of zero in addition to the dynamic value.
|
|
| Back to top |
|
|
Dr.Disrespect
Grandmaster Cheater
![]() Reputation: 3
Joined: 17 Feb 2016
Posts: 526
|
| Posted: Tue Mar 01, 2016 11:48 pm Post subject: |
|
|
| Zanzer wrote: | The function that is being called requires two parameters.
Whatever that function may be, it can perform all sorts of actions depending on what that value is.
However, the current process calling that function always wants it to perform the same action with a value of 0.
Lets say, for example, the function being called is a Math.Max function.
It takes two arguments and returns whichever one is greater.
Well, it can work against any two numbers that you send it.
However, the calling process only wants to make sure the dynamic value they have ([ebp-58]) is positive.
If it is negative, well then they just want to use the value of zero instead.
So, they ALWAYS pass the function a value of zero in addition to the dynamic value. |
Thank you for the reply, it helps a lot. 
Can you recommend some books or tutorials for me to read to get a better understanding of assembly language? I really want to learn it. I know some basic programming stuff, like a bit of Lua, C++, Swift.
|
|
| Back to top |
|
|
hhhuut
Grandmaster Cheater
 Reputation: 6
Joined: 08 Feb 2015
Posts: 607
|
| Posted: Wed Mar 02, 2016 2:55 am Post subject: |
|
|
| fmanager wrote: | | if I understand correctly, "push" is used for pushing a register on to the stack (storing the value in a register) |
For better understanding: The first part is correct, but the second part of your sentence (the one in brackets) is not the same!
The stack is an extra memory region where values can be stored to and loaded from, but it does not mean the value is stored in the shown register (in this case ecx)!
On the contrary, the value stored in ecx is kind of backed up in the stack.
With the instruction
you can overwrite the value currently stored in ecx with the value that is on top of the stack (basically [esp+00]).
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
