i am at a loss here, i don't even understand what this is:
.text:08049393 var_28 = dword ptr -28h
.text:08049393 var_24 = dword ptr -24h
.text:08049393 var_20 = dword ptr -20h
.text:08049393 var_1C = dword ptr -1Ch
.text:08049393 var_18 = dword ptr -18h
.text:08049393 var_14 = dword ptr -14h
.text:08049393 var_10 = dword ptr -10h
.text:08049393 var_C = dword ptr -0Ch
.text:08049393 arg_0 = dword ptr 8
.text:08049393 arg_4 = dword ptr 0Ch
it seems like variables are being assigned memory locations... why are they negative?
i guess i am having trouble understanding "the big picture".
Is there maybe something with pictures, arrows, and code that could give me the basics here?
Main Topics
Browse All Topics





by: Infinity08Posted on 2009-05-09 at 01:03:24ID: 24342788
>> when eax = *(esi + ebx * 4 - 8) + 5;
>>
>> how can this be true?
>> eax = *(esi + ebx * 4 - 4)
Well, it's quite straightforward, if you realize what esi is. What does it point to ?
>> I did some math incrementing ebx and found the equations are always 1 different from each other:
To be more exact, the calculated addresses have a difference of 4 == sizeof(int).
>> Could someone push me in the right direction?
Let me give you a hint : which arguments does read_six_numbers take ? What does the function do ? Where does it place its result ?
>> but i don't know how to assign values to the variables and take the loops for a "test run".
You can actually run the application - you'll be asked for input data, and you'll see the result of that.
If you want to observe the registry and stack contents while the code runs, you can run it inside a debugger, like gdb for example.
>> also i don't understand how to figure out ebp?
ebp is the base pointer. It points to the start of the current stack frame. A stack frame is set up at the beginning of each function call, and contains all local stack data for that function, as well as the return address, the saved ebp of the previous stack frame, etc.
This is where the stack frame is set up :
>> 08048dc0: push ebp
>> 08048dc1: mov ebp,esp
ie. the old base pointer is saved on the stack, so it can be restored when the function ends.
And the new base pointer is set to the current top of the stack to start a new stack frame.
At the end of the function, the stack frame is destroyed again, and we go back to the previous stack frame :
>> 08048e01: pop ebp
>> 08048e02: ret
ie. the saved base pointer is restored, and the code jumps to the return address (using ret)