I have an excel script which calls a function from a DLL file. I have opened the DLL file but I could not understand much from it.
The excel script defines the following structures:
Public Type Product
price As Double
size As Double
isExpensive As Boolean
isCheap As Boolean
isVerified As Boolean
isPacked As Boolean
isDelivered As Boolean
End Type
Public Type Pricing
value1 As Double
value2 As Double
value3 As Double
value4 As Double
End Type
Public Type Receipt
price As Double
location_x As Double
location_y As Double
time As Double
gross_weight As Double
special_weight As Double
discount As Double
dispatched As Boolean
paid As Boolean
End Type
Public Type Location
reputation As Double
id As Long
staffs As Long
location_x As Double
location_y As Double
working_weekends As Boolean
ventilated As Boolean
End Type
Public Type Output
future_week1 As Double
future_week2 As Double
future_week3 As Double
future_week4 As Double
future_week5 As Double
future_week6 As Double
future_week7 As Double
future_week8 As Double
future_week9 As Double
future_week10 As Double
future_week11 As Double
future_week12 As Double
future_week13 As Double
future_week14 As Double
future_week15 As Double
future_week16 As Double
future_week17 As Double
future_week18 As Double
End Type
and calls the following function
EstimateFuture myProduct, pricing1, pricing2, receipt1, location, myoutput
This function receives myProduct, pricing1, pricing2, receipt1, and location as input and it puts output in myoutput.
No matter if these structures are well designed or not. I need to understand the order of each field in memory.
The assembly beginning for estimation function is as following:
EstimateFuture:
push ebp
mov ebp,esp
and esp,FFFFFFF8h
sub esp,000000A0h
push esi
mov esi,[ebp+08h]
push edi
mov ecx,0000000Ch
mov edi,L1000F198
rep movsd
mov esi,[ebp+0Ch]
mov ecx,00000008h
mov edi,L1000F250
rep movsd
mov esi,[ebp+10h]
mov ecx,00000008h
mov edi,L1000F208
rep movsd
mov esi,[ebp+14h]
mov ecx,00000010h
mov edi,L1000F1C8
rep movsd
mov esi,[ebp+18h]
mov ecx,0000000Ah
mov edi,L1000F228
rep movsd
...
Apparently the code above is trying to store arguments into its memory. Here we have six arguments and five rep movsd. Maybe because five variables are input and the last one is not.
But what I don't understand is that in no way the addresses match the variables. Neither according to their size nor their label segmentation. Either arguments are stored in direct way or reverse way, they do not match with the addresses as following:
L1000F198:
dq 0000000000000000h
L1000F1A0:
dq 0000000000000000h
L1000F1A8:
db 00h;
db 00h;
db 00h;
db 00h;
L1000F1AC:
db 00h;
db 00h;
L1000F1AE:
db 00h;
db 00h;
db 00h;
db 00h;
L1000F1B2:
db 00h;
db 00h;
L1000F1B4:
db 00h;
db 00h;
db 00h;
db 00h;
L1000F1B8:
dq 0000000000000000h
L1000F1C0:
dq 0000000000000000h
L1000F1C8:
dq 0000000000000000h
L1000F1D0:
dq 0000000000000000h
L1000F1D8:
dq 0000000000000000h
L1000F1E0:
dq 0000000000000000h
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F1F0:
dq 0000000000000000h
L1000F1F8:
dq 0000000000000000h
L1000F200:
db 00h;
db 00h;
L1000F202:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F208:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F210:
dq 0000000000000000h
L1000F218:
dq 0000000000000000h
L1000F220:
dq 0000000000000000h
L1000F228:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F230:
dd 00000000h
L1000F234:
dd 00000000h
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F240:
dq 0000000000000000h
L1000F248:
db 00h;
db 00h;
L1000F24A:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F250:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F258:
dq 0000000000000000h
L1000F260:
dq 0000000000000000h
L1000F268:
dq 0000000000000000h
L1000F270:
dd 00000000h
L1000F274:
db 00h;
db 00h;
db 00h;
db 00h;
L1000F278:
dd 00000000h
L1000F27C:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F284:
dd 00000000h
L1000F288:
dd 00000000h
db 00h;
db 00h;
db 00h;
db 00h;
L1000F290:
dd 00000000h
L1000F294:
db 00h;
db 00h;
db 00h;
db 00h;
L1000F298:
db 00h;
db 00h;
db 00h;
db 00h;
I do not know the original language of this DLL file or the name or version of the compiler.
Could some one please fill this puzzle for me?
address of myProduct.price = ?
address of myProduct.size = ?
address of myProduct.isExpensive = ?
address of myProduct.isCheap = ?
address of myProduct.isVerified = ?
address of myProduct.isPacked = ?
address of myProduct.isDelivered = ?
address of pricing1.value1 = ?
address of pricing1.value2 = ?
address of pricing1.value3 = ?
address of pricing1.value4 = ?
address of pricing2.value1 = ?
address of pricing2.value2 = ?
address of pricing2.value3 = ?
address of pricing2.value4 = ?
address of receipt1.price = ?
address of receipt1.location_x = ?
address of receipt1.location_y = ?
address of receipt1.time = ?
address of receipt1.gross_weight = ?
address of receipt1.special_weight = ?
address of receipt1.discount = ?
address of receipt1.dispatched = ?
address of receipt1.paid = ?
address of location.reputation = ?
address of location.id = ?
address of location.staffs = ?
address of location.location_x = ?
address of location.location_y = ?
address of location.working_weekends = ?
address of location.ventilated = ?
address of myoutput.future_week1 = ?
address of myoutput.future_week2 = ?
address of myoutput.future_week3 = ?
address of myoutput.future_week4 = ?
address of myoutput.future_week5 = ?
address of myoutput.future_week6 = ?
address of myoutput.future_week7 = ?
address of myoutput.future_week8 = ?
address of myoutput.future_week9 = ?
address of myoutput.future_week10 = ?
address of myoutput.future_week11 = ?
address of myoutput.future_week12 = ?
address of myoutput.future_week13 = ?
address of myoutput.future_week14 = ?
address of myoutput.future_week15 = ?
address of myoutput.future_week16 = ?
address of myoutput.future_week17 = ?
Update
Thanks to matan7890, now I know that the address of myProduct is at L1000F228:
L1000F228:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F230:
dd 00000000h
L1000F234:
dd 00000000h
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
L1000F240:
dq 0000000000000000h
L1000F248:
db 00h;
db 00h;
L1000F24A:
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
db 00h;
it means:
address of myProduct.price = L1000F228 (8 bytes)
address of myProduct.size = L1000F230 (8 bytes)
address of myProduct.isExpensive = L1000F238 (4 bytes) -----> No Label
address of myProduct.isCheap = L1000F23C (4 bytes) -----> No Label
address of myProduct.isVerified = L1000F240 (4 bytes)
address of myProduct.isPacked = L1000F244 (4 bytes) -----> No Label
address of myProduct.isDelivered = L1000F248 (4 bytes)
Here, the problem is that myProduct.isExpensive, myProduct.isCheap and myProduct.isPacked have no label at their begining.
Other problems are that
myProduct.price is made of 8 single bytes instead of single 8 bytes.
myProduct.size must be 8 bytes but after 4 bytes another label is introduced.
It seems labels are not on their right place.
First of all, be aware that the arguments that you pass are ordered in reverse order to what you think in the stack. For example, your first variable myProduct is in [ebp+18h].
Also, Be aware that in vb Boolean is 4 bytes and not 1. So, your Product type is 36 bytes, Pricing is 32 bytes and so on. The movsd opcode copies 4 bytes at a time (dwords). By reading the reps, it seems that your arguments are not in the right order, because the second arguments copies 64 bytes (4 * 10h == 4 * 16 = 64), like your Receipt type. It seems that the right order of the arguments, only by reffering from the wanted sizes, are:
EstimateFuture myProduct, receipt1, pricing1, pricing2, location, myoutput
That means myProduct is seems to be in L1000F228 and the coming 40 bytes. Be aware that your structure is only 36 bytes, which means you may missing one Boolean member in that type.
From here you can calculate by yourself :)