tags:

views:

38

answers:

1

alt text

alt text

How to get the result 77D507EA manually from DS:[0040207A] according to register info above? UPDATE

memory map

+1  A: 

I see your using OllyDbg, so to make it a little relavent to your situation:

DS indicates that it(the address) is in the data segment, [0040207A] is the address in the data segment. if you goto (crtl + g in olly) address 0x40207A, you'll see some bytes, this is the pointer to MessageBoxA. just note that your missing the size of element pointed to by the address (in this case its DWORD PTR), the full instruction should be MOV EAX, DWORD PTR DS:[0040207A]

In the data dump(window in the bottom left), it should look something like: 0040207A EA 07 D5 77

In the CPU window, it might get properly analysed by olly(depends on the plugins and confings), in which case it'll look something like: 0040207A MessageBoxA EA 07 D5 77 User32.MessageBoxA

Also not, the address 0040207A might not be static, so going there will olly in a different session might not work, due to windows rebasing the virtualized binary

Update

It would appear that both your assembly knowledge and knowledge of x86 architecture is really poor, as such I would recommend that you read up on these subjects, wikipedia is a good start, else your not going to understand how addressing and pointers are handled on an assembly level

Necrolis
`0040207A = base_of_DS + 0040207A`,but how can I see `base_of_DS` in the first place?
COMer
@COMer: "base of DS" is defined in the PE of the image your examining, and it only applies to the image your exaiming. under olly you can use memory map(crtl-M iirc) to view the various memory mapped sections, `.data` is the Data Segment(just note though, thats not really true, 'DS:' can be used on anything, its just an accessing/addressing mode). you'll do well to give the art of assembly a read(its free these days)
Necrolis
The base of DS should be `77D507EA-0040207A=7794E770`,but I've checked the memory map(see my updated post),there is no such address :(
COMer
@COMer: no, `77D507EA` is a kernel function address, it has nothing to do with this, other than the fact its stored at `0040207A`. have a look at the segment registers section here: http://en.wikibooks.org/wiki/X86_Assembly/X86_Architecture `DS:` indications that it'll be data(it a hint, it can be ignore, data can be read from a code segment too). in your image the data segement(as set by the linker) starts at `0402000`, so you really have: `0402000` + `7A` = `0040207A`.
Necrolis