Log in

View Full Version : calculation under softice


newbcrk
August 5th, 2003, 05:43
lol

017F:00418D25 59 POP ECX
017F:00418D26 EB0F JMP 00418D37
017F:00418D28 0FB607 MOVZX EAX,BYTE PTR [EDI]
017F:00418D2B 8B0D10AE4200 MOV ECX,[0042AE10];; here I press F10 Before I have done d 42AE10
017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

:d 42ae10
:0030:0042AE10 1A AE 42 00 1A AE 42 00-00 00 20 00 20 00 20 00 ..B...B... . . .

After F10 I watch in my WR
And I find
:ECX=0042AE1A why ? It should be ECX = 0042AE10


Here I have some difficulties too

017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

I have EAX = 37h
I do 37*2+ 1A = 88 but in my wr EAX = 84 = AL

I try too 37*2 + 20 = 8E if I considere that ECX= 0042E1A And sotice gives another one EAX = 84 = AL
If I do d eax*2+ecx then the result gives 84

ArC
August 5th, 2003, 07:01
Quote:

:ECX=0042AE1A why ? It should be ECX = 0042AE10


8B0D10AE4200 MOV ECX,[0042AE10]
This opcode causes that the contents of 0042ae10 will be copied
to ecx.

esther
August 5th, 2003, 07:09
After F10 I watch in my WR
And I find
:ECX=0042AE1A why ? It should be ECX = 0042AE10

cuz you do F10 it will step into next instruction

Regards

naides
August 5th, 2003, 09:49
Quote:
Originally posted by newbcrk
lol

017F:00418D25 59 POP ECX
017F:00418D26 EB0F JMP 00418D37
017F:00418D28 0FB607 MOVZX EAX,BYTE PTR [EDI]
017F:00418D2B 8B0D10AE4200 MOV ECX,[0042AE10];; here I press F10 Before I have done d 42AE10
017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

:d 42ae10
:0030:0042AE10 1A AE 42 00 1A AE 42 00-00 00 20 00 20 00 20 00 ..B...B... . . .

After F10 I watch in my WR
And I find
:ECX=0042AE1A why ? It should be ECX = 0042AE10


Here I have some difficulties too

017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

I have EAX = 37h
I do 37*2+ 1A = 88 but in my wr EAX = 84 = AL

I try too 37*2 + 20 = 8E if I considere that ECX= 0042E1A And sotice gives another one EAX = 84 = AL
If I do d eax*2+ecx then the result gives 84



You problem lays in understanding the significance of brackets: They provide the Assembly equivalent of C pointers

017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

in this instruction, what gets moved to AL is the byte contained at the address ds:EAX*2+ECX

not the result of the EAX*2+ECX operation, 84 in your particular example

Such instruction would be:

017F:00418D31 8A0441 MOV AL,EAX*2+ECX

Hope this makes it clear

newbcrk
August 5th, 2003, 13:12
Yes I don’t know the significance of the brackets .
I believed that it was in the memory of the stack ,only .Right or false?
And is the contents of the brackets always pointed by the ds register ?

evaluator
August 5th, 2003, 14:26
if no other prefix done, usualy from DS

newbcrk
August 6th, 2003, 03:07
thanks