Hello,
I've got a quick question after reading few articles describing ASM. As far as I know, registers are used to store variable (except EIP) and each of them have limited size. I disassembled some applications just to take a look at source and I don't understand one thing. If EBP is used to store a single variable, how such instruction can be correct?
mov [EBP+08], eax
And second thing - how can I use function from other application (let's say via injected DLL)? I know it's address, what parameters I must push to the stack and what registers must contain to be executed correctly. So, in Delphi, using asm .. end tags I've pushed the parameters on to the stack, tried moving variables into registers, called the function and tried moving EAX to Result variable. The problem is, that according to OllyDbg after calling the procedure the registers got changed to it's (probably) original state.
Thanks in advance :)
Start Free Trial