📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  How to generify data for "mov" instruction ?

Topic created on: September 30, 2010 13:56 CDT by Usman .

Hello,

I need to understand just 1 single instruction and accordingly I need to generify the things.

I need to pass structures (Objects of User Defined Data Types) at runtime using following assembly code.

Where Following is User Defined Data Type namely WESContext :

typedef struct CWESContext
{

BSTR UserName;
BSTR MachineIP;
BSTR Certificate;
BSTR BrowserClienthandle;//Its the handle of the BrowserClient or Java Application Level Object
BSTR SessionID;
BSTR TaskID;// name of the original task

long LocaleID;//The location of the ultimate Caller
long FeatureID;//The feature ID mapping to some feature available in WESFW
long SessionTypeID;//Itmay be; Browser CLient Session, OPC Client Session, Authenticated OPC Clients session(as they have more rights), WESFWSystemClient.

SYSTEMTIME TimeStamp;//the time the original task was executed
DWORD Priority; //task priority of the original task

struct WESProductCategory
{
BSTR ProductCategoryName;
int serialNo;

struct WESDimensions
{
int weight;        
struct WESVolume
{
int length;
int heigth;
int width;
}oVolume;

BSTR tempHeight;
BSTR otherUnknownDimensions;
}oDimensions;      
}oWESProductCategory;
} CWESContext;

I have created the block enough of size WESContext and filled it with sample data.

int sizeOfWESContext = sizeof(CWESContext);

void *pWESContext = malloc(sizeOfWESContext);
void *pGenericPtr = pWESContext;
memset(pWESContext,0,sizeOfWESContext);

BSTR *bstrUserName = (BSTR*)pGenericPtr;
*bstrUserName = SysAllocString(CT2OLE(CA2T(results.at(0).c_str())));
bstrUserName++;

pGenericPtr = bstrUserName;

BSTR *bstrMachineIp = (BSTR*)pGenericPtr;
*bstrMachineIp = SysAllocString(CT2OLE(CA2T(results.at(1).c_str())));
bstrMachineIp++;

pGenericPtr = bstrMachineIp;

BSTR *bstrCertificate = (BSTR*)pGenericPtr;
*bstrCertificate = SysAllocString(CT2OLE(CA2T(results.at(2).c_str())));
bstrCertificate++;

pGenericPtr = bstrCertificate;

                .....................
                so on so forth...............


If I call it by passing this as object:

Calling Normaly : [\b]
MyCallableMethodUDT(*((CWESContext*)pWESContext));

Now following assembly i just pulled from Dissasembly view of Visual Studio while debugging.



  mov         esi,dword ptr [pWESContext]  
  sub         esp,58h  
[b]mov         ecx,16h
  
  mov         edi,esp  
  rep movs    dword ptr es:[edi],dword ptr [esi]

I just need to understand 3rd line..
AS I increase members inside my User Defined Structure (i.e here WESContext) it increases but I am unable to conclude how it increases....? I need to generify this instruction so that whatever the Object is and whatever the size and whatever kind of data it contains....it should get pass by calling it with writing assembly instruction as written above.

Regards,
Usman

  Smallpox   November 1, 2010 20:04.02 CDT
The third line, mov ecx, 16h, is used to set the number of times movs is repeated to copy the WESContext onto the stack for the function call(since it's calling by value). The WESContext is 16h dwords in size in this case, but if you change the number of members in WESContext it will change its size, and consequently the value being put in ecx.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit