Search code examples
assemblyx86reverse-engineering

Assembly Language (Find the following query as mentioned below)


Need help on below code and queries.

My understanding of the code below suggests it will get stuck in an infinite loop.

  1. What is the return value from DemoFunction2?
  2. What is the purpose of DemoFunction2?

    //
    
    0:000> uf    010024d0
    
    asmdemo2!DemoFunction2:
    
    010024d0 55                push    ebp
    
    010024d1 8bec              mov     ebp,esp                
    
    010024d3 8b5508            mov     edx,dword ptr [ebp+8] 
    
    010024d6 33c0              xor     eax,eax               
    
    010024d8 b920000000        mov     ecx,20h              
    
    010024dd d1ea              shr     edx,1               
    
    010024df 7301              jnc     asmdemo2!DemoFunction2+0x12 (010024e2)
    
    010024e1 40                inc     eax                   
    
    010024e2 e2f9              loop    asmdemo2!DemoFunction2+0xd (010024dd)
    
    010024e4 5d                pop     ebp
    
    010024e5 c3                ret
    
    
    0:000> r
    eax=80002418    ebx=7ffd7000    ecx=00682295   edx=00000000   esi=80002418 
    edi=00000002
    eip=010024d0   esp=0006fe98    ebp=0006fea8    iopl=0         nv up ei pl zr na 
    pe nc
    cs=001b    ss=0023   ds=0023   es=0023   fs=003b   gs=0000             
    efl=00000246
    
    asmdemo2!DemoFunction2:
    
    010024d0 55              push    ebp
    
    0:000> dps   esp
    
    0006fe98  0100251c asmdemo2!main+0x20
    
    0006fe9c  80002418
    
    0006fea0  00000002 
    
    0006fea4  00000000
    
    0006fea8  0006ff88
    
    0006feac  01002969 asmdemo2!_mainCRTStartup+0x12c
    
    0006feb0  00000002
    
    0006feb4  00682270
    
    0006feb8  006822b8
    
    0006febc  f395c17d
    
    0006fec0  00000000
    
    0006fec4  00000000
    
    0006fec8  7ffd7000
    
    0006fecc  00000000
    
    0006fed0  00000000
    
    0006fed4  00000000
    
    0006fed8  00000094
    
    0006fedc  00000006
    
    0006fee0  00000000
    
    0006fee4  00001771
    
    0006fee8  00000002
    
    0006feec  76726553
    
    0006fef0  20656369
    
    0006fef4  6b636150
    
    0006fef8  00003120
    
    0006fefc  00000000
    
    0006ff00  00000000
    
    0006ff04  00000000
    
    0006ff08  00000000
    
    0006ff0c  00000000
    
    0006ff10  00000000
    
    0006ff14  00000000
    

Solution

  • No it is not an infinite loop.

    At the beginning ecx is set to 32.
    Every time the loop instruction executes ecx is decremented by 1.
    When ecx reaches 0, the loop instruction will fall through (not jump) and the instructions thereafter will be executed (pop+ret).

    Obviously the code is inefficient.

    A simple

    popcnt eax,[esp+4]
    ret
    

    Would do the same function much faster, but it works.

    It counts the number of set bits in the first argument, using the cdecl calling convention.