views:

92

answers:

6

I have an exe which I have opened with PE Explorer Disassembler. Now I can see the asm code, which looks like that:

    push    ebx
    push    esi
    mov ebx,eax
    mov eax,[ebx+38h]
    push    eax
    mov eax,[ebx+3Ch]
    push    eax
    mov ecx,edx
    mov eax,ebx
    mov edx,[ebx+30h]
    mov esi,[eax]
    call    [esi+7Ch]
    or  byte ptr [ebx+00000088h],02h
    pop esi
    pop ebx
    retn

I have no idea what that means. Is there a way to convert this now into read-able code (C, C++, C# or VB.NET)?

Background info: The reason why I need this is because I need to call the above function from my windows app. Now this function resides in the third party exe - there is no API or source-code for it. Any help or advice is appreciated.

A: 

What you want is called "decompilation".

That is not easy to solve task, and often not possible at all. You might try this as a start:

http://www.google.de/search?q=decompiler&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-GB:official&client=firefox-a#hl=en&client=firefox-a&hs=FTt&rls=org.mozilla%3Aen-GB%3Aofficial&q=x86+decompiler&aq=f&aqi=&aql=&oq=&gs_rfai=&pbx=1&fp=96e43bb49e04463f

BarsMonster
@BarsMonster: I read the following article on cp: http://www.codeproject.com/KB/cpp/funccaller.aspx - Cant I apply the same methods?
vikasde
That is what decompillers do(among many other things). Surely you can do that, but this is not a 5 minutes task.
BarsMonster
ok. I tried to do it the way it was described in the article, but couldnt find any functions at all that would make sense to me.
vikasde
A: 

You can decompile it into C or some other language with pointers, but it will still be mostly unreadable.

Longpoke
A: 

It is possible but as far as I know, there no free tools available for converting ASM code into a higher level language.

If you are willing to pay money then you might want to look at http://www.microapl.co.uk/asm2c/ or http://www.mpsinc.com/ (the latter has it under "Conversion Tools" -> "Assembly data sheets").

Saul
+2  A: 

If you can get a hold of it, IDA Pro + Hex-Rays could decompile that into semi-readable code.

Zor
A: 

Well, to call it, you would need to know what arguments are used. In this case, it looks like the arguments are passed to this routine in the eax & edx registers. Once you know what those values mean, you can probably figure out how this routine is used and re-code it in whatever language you're using.

Sagian
A: 

At first glance, it's objectual code; it gets (at least) an object as argument, calls a method of that object which takes as arguments three of the object's attributes and then sets a bit (flag?) in another attribute of the same object to one.

IDA Pro would probably be able to identify the function prototype and it has a free version available which has all the features you need: http://www.hex-rays.com/idapro/idadownfreeware.htm . It will however only give you an idea of the function's prototype, not it's behavior (unless you can "read" x86 assembly). Reverting it to plain C/C++ requires the HexRays plugin which is rather expensive and doesn't always work (decompilation to a high level language is rather complicated).

Vlad