Showing posts with label EAX. Show all posts
Showing posts with label EAX. Show all posts

Friday, January 24, 2020

assembly basics: strcmp ; test eax, eax

push eax (1st string to compare)
push ecx (2nd string to compare)
call strcmp (do the compare using C library ... if same EAX = 0, if different EAX = 1)
test eax, eax (same as 'and eax, eax' ... so if EAX = 0 ZF = 1 ... if EAX = 1 ZF = 0)
jz loc_40124C (so jump if zero jumps if ZF = 1 ... which is when EAX = 0)

------

In simpler terms
- compare the 2 strings
- if same
  - EAX gets set to 0
  - ZF gets set to 1
  - JZ will jump because ZF = 1
- if different
  - EAX gets set to 1
  - ZF gets set to 0
  - JZ will NOT jump because ZF = 0

------

In simplest terms 
  if you see " strcmp ; test ; jz "
    JZ green if the 2 strings are the same (0)
    JZ red if the 2 strings are different (non 0)

  if you see " strcmp ; test ; jnz "
    JNZ green if the 2 strings are different (non 0)
    JNZ red if the 2 strings are the same (0)

  if you see " strlen; test ; jz "
    JZ green if empty string (0)
    JZ red if non-empty string (non 0)

  if you see " strlen ; test ; jnz "
    JNZ green if non-empty string (non 0)
    JNZ red if empty string (0)

  if you see " call; test ; jz "
    JZ green if function call successful (0)
    JZ red if function call failed (non 0)

  if you see " call ; test ; jnz "
    JNZ green if function call failed (non 0)
    JNZ red if function call successful (0)

  if you see " cmp ; test ; jz "
    JZ green if the 2 numbers are the same (0)
    JZ red if the 2 numbers are different (non 0)

  if you see " cmp ; test ; jnz "
    JNZ green if the 2 numbers are different (non 0)
    JNZ red if the 2 numbers are the same (0)


Jump arrows
Green: if condition is satisfied (JZ=0, JNZ=non-0)
Red: if the condition is not satisfied (JZ=non-0, JNZ=0)


Friday, November 9, 2018

IDA Python Get String pointed to by Register

Related to this blog post
https://neonprimetime.blogspot.com/2018/10/malwaretech-ida-python-cheatsheet.html

If you're in IDA and you have a register, say EAX pointing to a location

RAX 000000000018FB7C

0018FB7C db 6Dh ; m
0018FB7D db 73h ; s
0018FB7E db 63h ; c
0018FB7F db 6Fh ; o
0018FB80 db 72h ; r
0018FB81 db 6Ah ; j
0018FB82 db 69h ; i
0018FB83 db 74h ; t
0018FB84 db 2Eh ; .
0018FB85 db 64h ; d
0018FB86 db 6Ch ; l
0018FB87 db 6Ch ; l
0018FB88 db 0 ; 0

And you want to print out that string go to
File -> Script Command

Choose Python as your scripting language

type in this command and hit run

print(GetString(GetRegValue("EAX")))

which displays in the Output Window
mscorjit.dll