atlas
May 1st, 2004, 14:36
lol
I need explications on instructions like [ebp+...]
Example
I need explications on instructions like [ebp+...]
Example
Code:
017F:004F3CC7 8B45DC MOV EAX,[EBP-24]
017F:004F3CCA 83C410 ADD ESP,10
017F:004F3CCD 85C0 TEST EAX,EAX
017F:004F3CCF 7505 JNZ 004F3CD6
017F:004F3CD6 8B4D14 MOV ECX,[EBP+14]
017F:004F3CD9 8B55EC MOV EDX,[EBP-14]
017F:004F3CDC 51 PUSH ECX
017F:004F3CDD 8B4D0C MOV ECX,[EBP+0C]
017F:004F3CE0 50 PUSH EAX
017F:004F3CE1 8B4510 MOV EAX,[EBP+1
017F:004F3CE4 52 PUSH EDX
017F:004F3CE5 50 PUSH EAX
017F:004F3CE6 51 PUSH ECX
017F:004F3CE7 E864FDFFFF CALL 004F3A50
017F:004F3A50 55 PUSH EBP
017F:004F3A51 8BEC MOV EBP,ESP
017F:004F3A53 6AFF PUSH FF
017F:004F3A55 68009B5400 PUSH 00549B00
017F:004F3A5A 64A100000000 MOV EAX,FS:[0000000
017F:004F3A60 50 PUSH EAX
017F:004F3A61 64892500000000 MOV FS:[0000000 ,ESP
017F:004F3A68 51 PUSH ECX
017F:004F3A69 53 PUSH EBX
017F:004F3A6A 8B5D08 MOV EBX,[EBP+08];
; ebp+08;;gives a interressant value to EBX
;; and now ?How to ascend the code ?Wich supplies a value to ebp+08 ?
017F:004F3A6D 56 PUSH ESI
017F:004F3A6E 57 PUSH EDI
017F:004F3A6F 8D43FF LEA EAX,[EBX-01];
; ebx gives a interressant value to EAX
017F:004F3A72 33D2 XOR EDX,EDX
017F:004F3A74 33F6 XOR ESI,ESI
017F:004F3A76 83F810 CMP EAX,10
017F:004F3A79 8965F0 MOV [EBP-1 ,ESP
017F:004F3A7C 8955FC MOV [EBP-04],EDX
017F:004F3A7F BFF0F0F0F0 MOV EDI,F0F0F0F0
017F:004F3A84 B 0 JA 04F3B79
;;good boy - bad boy