Posted: Fri Jan 24, 2020 9:03 pm Post subject: Understanding instructions from disassembler
Hi, I've been playing around step 5 of the tutorial (gives a value that you can change). I found the address of the value, and after selecting "find what writes to this address" I opened up the disassembler. I set a breakpoint at the instruction that gave a new value everytime the button is pressed, and I'm able to see from the debugger in "mov [eax], edx" that edx = the new value (in hex), which makes sense.
However, I'm trying to find what instruction set edx to the new value prior to this instruction. An immediate row above, I find "move edx, [ebp - 10]". Now my question is, what is [ebp - 10]?
I keep going up the rows until I find "mov [ebp - 10], eax", and now I want to find what eax is. A few rows above, I find "mov eax, 000003E8".
0x000003E8 = 1000 in decimal. So if that value is put in register eax -> moved to memory location [ebp - 10] -> then from there put in edx -> then
finally put into [eax] , why is the new value displayed as "647", as well as in the instruction breakpoint's debugger the value of EDX is 0x289 or "647" as well. Should it not be 1,000?
The call instruction at exe+268E5 (just after mov eax,3e8) probably does something that returns a value in eax. Right click on that call instruction and select "follow" or something to go to the called address in the disassembler and see what's going on.
Across call instructions, registers can be either volatile or nonvolatile. Volatile registers might not have the same value they had prior to the call instruction, while nonvolatile registers are guaranteed to have the same value. eax is a volatile register, so whenever you see a call instruction, you can't assume it will still have the same value. _________________
I don't know where I'm going, but I'll figure it out when I get there.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum