[Solved] Can you help me to explain this asm code? [closed]

by


(My assembly is a bit rusty, anyone please correct me if I’m wrong):

  1. esp is the current stack-pointer, which is where locals and parameters typically live. esp+8 would access an item that is 8 bytes offset from the current stack-frame address. The [x] denotes a dereferencing, so the local is a pointer type.
  2. This value is copied into the ecx general-purpose register.
  3. The value of ecx is then interpreted as a pointer and is dereferenced into edx, indicating it’s a pointer-to-pointer type.
  4. The value of edx is incremented (possibly pointing to the next element in an array with 1-byte sized elements).
  5. The value of edx is copied back into the address that ecx is pointing at.
  6. edx is then decremented.
  7. The stack value at offset 4 is copied into the lower 8 bits of the a register (which is a different view of the eax and ax register).
  8. This value is then copied into whereever edx is pointing to.
  9. The same value from step 7 is re-used and ANDed with 0xFF – which is effectively the same thing as copying into al (as both only handles the lower 8 bits of the value).
  10. Finally retn gets the return address from the stack and resumes execution from that address onward.

In C, I think this is a close approximation:

...
char* a = ... // local at offset +4
char** b = ... // local at offset +8
char* c = *b;
c++;
(*c)--;
*c = a; // lower 8-bits implicit if `sizeof(char) == 1` and 1 byte is 8 bits (non-octet systems do exist)
char* d = a & 0xFF;
return;

I’m not entirely sure what’s going on here as it looks like you’re missing instructions that came before what you posted.

3

solved Can you help me to explain this asm code? [closed]