psyCK0
November 9th, 2003, 19:56
When I try to debug an exe that includes this code:
<pre>
GetFile proc hWin:HWND
mov ofn.lStructSize,SIZEOF ofn
push hWin
pop ofn.hWndOwner
push hInstance
pop ofn.hInstance
mov ofn.lpstrFilter, OFFSET FilterString
mov ofn.lpstrFile, OFFSET buffer
mov ofn.nMaxFile,MAXSIZE
mov ofn.Flags, OFN_FILEMUSTEXIST or \
OFN_PATHMUSTEXIST or OFN_LONGNAMES or \
OFN_EXPLORER or OFN_HIDEREADONLY
invoke GetOpenFileName, ADDR ofn
ret
GetFile endp
DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM
mov eax,uMsg
.if eax == WM_INITDIALOG
; Set up dialog icons
invoke LoadImage, hInstance, addr szFileIcon, IMAGE_ICON, 32, 32, LR_LOADFROMFILE
.if eax != 0
invoke SendMessage, hWin, WM_SETICON, ICON_BIG, eax
.endif
</pre>
....
....
Ollys analysis produces:
....
....
<pre>
00401031 $ 55 PUSH EBP
00401032 . 8BEC MOV EBP,ESP
00401034 . C705 31314000>MOV DWORD PTR DS:[ofn],4C
0040103E . FF75 08 PUSH DWORD PTR SS:[EBP+8]
00401041 . 8F05 35314000 POP DWORD PTR DS:[403135]
00401047 . FF35 80314000 PUSH DWORD PTR DS:[403180]
0040104D . 8F05 39314000 POP DWORD PTR DS:[403139]
00401053 C7 DB C7
00401054 05 DB 05
00401055 > 3D314000 DD Cryptor.0040313D
00401059 0E304000 DD OFFSET Cryptor.FilterString ; ASCII "EXE Files"
0040105D . C705 4D314000>MOV DWORD PTR DS:[40314D],OFFSET Cryptor>
00401067 . C705 51314000>MOV DWORD PTR DS:[403151],104
00401071 . C705 65314000>MOV DWORD PTR DS:[403165],281804
0040107B . 68 31314000 PUSH OFFSET Cryptor.ofn ; /pOpenFileName = OFFSET Cryptor.ofn
00401080 . E8 B5000000 CALL <JMP.&comdlg32.GetOpenFileNameA> ; \GetOpenFileNameA
00401085 . C9 LEAVE
00401086 . C2 0400 RETN 4
00401089 55 DB 55 ; CHAR 'U'
0040108A 8B DB 8B
0040108B EC DB EC
0040108C 8B DB 8B
0040108D 45 DB 45 ; CHAR 'E'
0040108E 0C DB 0C
0040108F 3D DB 3D ; CHAR '='
00401090 10 DB 10
00401091 01 DB 01
00401092 00 DB 00
00401093 00 DB 00
00401094 75 DB 75 ; CHAR 'u'
00401095 2E DB 2E ; CHAR '.'
00401096 6A DB 6A ; CHAR 'j'
00401097 10 DB 10
00401098 6A DB 6A ; CHAR 'j'
00401099 20 DB 20 ; CHAR ' '
0040109A 6A DB 6A ; CHAR 'j'
0040109B 20 DB 20 ; CHAR ' '
0040109C 6A DB 6A ; CHAR 'j'
0040109D 01 DB 01
0040109E 68 DB 68 ; CHAR 'h'
0040109F 00304000 DD OFFSET Cryptor.szFileIcon ; ASCII "xxx.ico"
004010A3 FF DB FF
004010A4 35 DB 35 ; CHAR '5'
004010A5 80314000 DD Cryptor.00403180
004010A9 E8 DB E8
004010AA 74 DB 74 ; CHAR 't'
004010AB 00 DB 00
004010AC 00 DB 00
004010AD > 00 DB 00
004010AE . 0BC0 OR EAX,EAX
004010B0 . 74 55 JE SHORT Cryptor.00401107
004010B2 . 50 PUSH EAX ; /lParam
004010B3 . 6A 01 PUSH 1 ; |wParam = 1
004010B5 . 68 80000000 PUSH 80 ; |Message = WM_SETICON
004010BA . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
004010BD . E8 6C000000 CALL <JMP.&user32.SendMessageA> ; \SendMessageA
</pre>
....
....
Why is it showing all this DB stuff???
<pre>
GetFile proc hWin:HWND
mov ofn.lStructSize,SIZEOF ofn
push hWin
pop ofn.hWndOwner
push hInstance
pop ofn.hInstance
mov ofn.lpstrFilter, OFFSET FilterString
mov ofn.lpstrFile, OFFSET buffer
mov ofn.nMaxFile,MAXSIZE
mov ofn.Flags, OFN_FILEMUSTEXIST or \
OFN_PATHMUSTEXIST or OFN_LONGNAMES or \
OFN_EXPLORER or OFN_HIDEREADONLY
invoke GetOpenFileName, ADDR ofn
ret
GetFile endp
DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM
mov eax,uMsg
.if eax == WM_INITDIALOG
; Set up dialog icons
invoke LoadImage, hInstance, addr szFileIcon, IMAGE_ICON, 32, 32, LR_LOADFROMFILE
.if eax != 0
invoke SendMessage, hWin, WM_SETICON, ICON_BIG, eax
.endif
</pre>
....
....
Ollys analysis produces:
....
....
<pre>
00401031 $ 55 PUSH EBP
00401032 . 8BEC MOV EBP,ESP
00401034 . C705 31314000>MOV DWORD PTR DS:[ofn],4C
0040103E . FF75 08 PUSH DWORD PTR SS:[EBP+8]
00401041 . 8F05 35314000 POP DWORD PTR DS:[403135]
00401047 . FF35 80314000 PUSH DWORD PTR DS:[403180]
0040104D . 8F05 39314000 POP DWORD PTR DS:[403139]
00401053 C7 DB C7
00401054 05 DB 05
00401055 > 3D314000 DD Cryptor.0040313D
00401059 0E304000 DD OFFSET Cryptor.FilterString ; ASCII "EXE Files"
0040105D . C705 4D314000>MOV DWORD PTR DS:[40314D],OFFSET Cryptor>
00401067 . C705 51314000>MOV DWORD PTR DS:[403151],104
00401071 . C705 65314000>MOV DWORD PTR DS:[403165],281804
0040107B . 68 31314000 PUSH OFFSET Cryptor.ofn ; /pOpenFileName = OFFSET Cryptor.ofn
00401080 . E8 B5000000 CALL <JMP.&comdlg32.GetOpenFileNameA> ; \GetOpenFileNameA
00401085 . C9 LEAVE
00401086 . C2 0400 RETN 4
00401089 55 DB 55 ; CHAR 'U'
0040108A 8B DB 8B
0040108B EC DB EC
0040108C 8B DB 8B
0040108D 45 DB 45 ; CHAR 'E'
0040108E 0C DB 0C
0040108F 3D DB 3D ; CHAR '='
00401090 10 DB 10
00401091 01 DB 01
00401092 00 DB 00
00401093 00 DB 00
00401094 75 DB 75 ; CHAR 'u'
00401095 2E DB 2E ; CHAR '.'
00401096 6A DB 6A ; CHAR 'j'
00401097 10 DB 10
00401098 6A DB 6A ; CHAR 'j'
00401099 20 DB 20 ; CHAR ' '
0040109A 6A DB 6A ; CHAR 'j'
0040109B 20 DB 20 ; CHAR ' '
0040109C 6A DB 6A ; CHAR 'j'
0040109D 01 DB 01
0040109E 68 DB 68 ; CHAR 'h'
0040109F 00304000 DD OFFSET Cryptor.szFileIcon ; ASCII "xxx.ico"
004010A3 FF DB FF
004010A4 35 DB 35 ; CHAR '5'
004010A5 80314000 DD Cryptor.00403180
004010A9 E8 DB E8
004010AA 74 DB 74 ; CHAR 't'
004010AB 00 DB 00
004010AC 00 DB 00
004010AD > 00 DB 00
004010AE . 0BC0 OR EAX,EAX
004010B0 . 74 55 JE SHORT Cryptor.00401107
004010B2 . 50 PUSH EAX ; /lParam
004010B3 . 6A 01 PUSH 1 ; |wParam = 1
004010B5 . 68 80000000 PUSH 80 ; |Message = WM_SETICON
004010BA . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
004010BD . E8 6C000000 CALL <JMP.&user32.SendMessageA> ; \SendMessageA
</pre>
....
....
Why is it showing all this DB stuff???