a silly question about asm of a very newbie

[bacsi]

i just started self-learning asm today n here is a lildo code which i dont understand, somebody please explain the code for me, thank you very much

i already wrote some explanations, plz correct me if any of them is incorrect

[detten]

cmp byte ptr [eax], 90 ; compare the byte eax points to with 90h.

eax holds an address of some memory place, if you check what is on that address ('follow in dump' if you use olydbg), you should see what the 90h is compared to.

In your piece of code, 00401000 till 0040105F is being scanned for the byte 90h. ECX is the counter with the remaining bytes to scan.
If 90h is found the algo jumps out of the loop. (je 00401014)
Since the memory we scan is the memory we are executing, you can be pretty sure it is checking if you nopped out code. (patched with 90h)

I think you got confused by the intel argument order :

[bengunn]

deleted post, detten posted a second earlier

[bacsi]

is it wrong when i changed the value into decimal so i can understand the code better?

[BoR0]

Don't convert values to decimal, trust me. Reading in HEX and memory is easier. Decimal will only double your work.

[parabytes]

Heyyyy.... That's one of my first crackmes

[Koffee]

bacsi -

if you are coming from a C/C++ background it may be easier to think of eax and ecx used as pointers. when registers are wrapped with the square bracket it does the same thing as the * operator in C. Get me the contents of this memory address.

[ColdWinterWind]

[parabytes]

Hex was chosen simply because it's a power of 2...

It's easier to convert binary and hex because it's the same logic behind them, being both power of 2. If you might have noticed or not, a nibble (one hex number) is 4 bits, octal digits (for the matter) are 3 bits...

Which is why both were chosen, and that's the reason why base64 was next in line (using 32 was redundant.)

Easier transformation for us, humans. But still, we have 10 fingers and 10 toes, so we can count to 10. That's why everything in our lives has a sense of decimal base in them. Arabic, Japanese, Indians, Europeans. Everyone used the decimal base because that is our limit, we can only count upto 10 fingers. Unless we're disfigured and got an extra toe/finger/etc..


IDA, Olly, real disassembling engines, use hex purely (unless stated or requested otherwise.) while VS debugger is using decimal because many people are still trapped in a cage of 10 fingers.

That's why it will always stay this way. It's human nature.

[ColdWinterWind]

Nicely said, parabytes!

[w0uter]

isnt

dec ecx ; 95 + 1

95 - 1

[parabytes]

It is, it's probably a mistake.

I believe this code is one of my first works, written in TASM... the only NOP seeker I've ever saw is there

Correct me if I'm wrong... :]