📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  main() stack

Topic created on: March 9, 2011 21:24 CST by solvman .

Hi,

I am new to reversing. My apologies if question sounds to beginer-ish :) I have created simple code in Visual Studio C++ 2010:

int main()
{
    return 0;
}

Whenever I open it in Olly it shows the following state of the stack with execution paused:

0012FFC4   7C817077  RETURN to kernel32.7C817077
0012FFC8   7C910228  ntdll.7C910228
0012FFCC   FFFFFFFF
0012FFD0   7FFD5000
0012FFD4   80544CFD
0012FFD8   0012FFC8
0012FFDC   82537DA8
0012FFE0   FFFFFFFF  End of SEH chain
0012FFE4   7C839AD8  SE handler
0012FFE8   7C817080  kernel32.7C817080
0012FFEC   00000000
0012FFF0   00000000
0012FFF4   00000000
0012FFF8   004012A0  Reversin.<ModuleEntryPoint>
0012FFFC   00000000

Please help new bee to understand what's been stored here. Thank you in advance.

  computergeek01   April 11, 2011 16:06.11 CDT
I've read your post about 4 times, 6 or 7 if you include the one that you left over on stackoverflow, and the only answer I can think to give you is not a G* D* thing. Your program literally does nothing, what you have here tells the OS that your entry point is going to return an integer to it when it is finished and then it immediatly returns 0, indicating it completed successfully. That line at 0012FFC4 that says: "RETURN to kernel32..." is your whole program, the rest I would assume is the command shell cleaning up after itself.

In order to analyse the stack you should at least save a variable or two. Even if they don't do anything you get to see what it looks like in the debugger this way.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit