FPU Stack in Olly? [Archive] - RCE Messageboard's Regroupment

stamat

September 15th, 2011, 12:07

My asm knowledge is basic so I need help with the following lines. I tried to comment the code - please correct if needed.

Code:



006E3F72    FSTP QWORD PTR SS:[EBP-18]	//Save top of FP stack value to QWORD PTR SS:[EBP-18]



...



0040CDF0    FLD QWORD PTR SS:[ESP]	//Load value of QWORD PTR SS:[ESP] on top of FP stack



...



006E4277    FCOMP QWORD PTR SS:[EBP-18]	//Compare value of QWORD PTR SS:[EBP-18] to top of FP stack value

006E427A    FSTSW AX			//...

006E427C    SAHF			//...

006E427D    JA 006E4378			//jump based on the comparison above

Where can I monitor the floating point stack when debugging with Olly?

This is my fist post in the forum... I hope I have not broken any rules.

blabberer

September 16th, 2011, 18:43

fpu registers are in first quadrant
if you dont see it click the bar on the top

it should cycle through FPU MMX and 3dNow! registers

or right click on register pane and click view float registers

Code:





CPU - main thread, module ntdll



EAX 00261EB4

ECX 00000007

EDX 00000080

EBX 7FFD9000

ESP 0013FB20

EBP 0013FC94

ESI 00261F48

EDI 00261EB4

EIP 7C90120F ntdll.7C90120F



C 0  ES 0023 32bit 0(FFFFFFFF)

P 0  CS 001B 32bit 0(FFFFFFFF)

A 0  SS 0023 32bit 0(FFFFFFFF)

Z 0  DS 0023 32bit 0(FFFFFFFF)

S 0  FS 003B 32bit 7FFDF000(FFF)

T 0  GS 0000 NULL

D 0

O 0  LastErr 00000000 ERROR_SUCCESS

EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)



ST0 empty +UNORM 005A 0013ADB8 0013B8E0

ST1 empty +UNORM 3E4D 0013ADA0 0013ADB8

ST2 empty +UNORM 0001 0013B344 0000002D

ST3 empty -UNORM ADB8 004E4831 0013B31C

ST4 empty +UNORM 0022 00000000 0040926C

ST5 empty +UNORM 0033 006D0073 0061006D

ST6 empty +UNORM 0074 00750074 007A0063

ST7 empty +UNORM 0030 00650074 00750074

               3 2 1 0      E S P U O Z D I

FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0 (GT)

FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

Last cmnd 0000:00000000



XMM0 0065006B 005C0064 006F006D 00790065

XMM1 00650078 0065002E 0064006F 006D0079

XMM2 00780065 002E0064 006F006D 00790022

XMM3 00000000 00000000 00000000 00000065

XMM4 00000000 00000000 00000000 00000000

XMM5 00000000 00000000 00000000 00000000

XMM6 004E30B0 00000000 00000000 00000000

XMM7 00000000 00000000 0000002D 0013B344

                                P U O Z D I

MXCSR 00001F80  FZ 0 DZ 0  Err  0 0 0 0 0 0

                Rnd NEAR   Mask 1 1 1 1 1 1

in ollydbg 1.1 xmm registers are not visible only st1 etc