Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-26-2012, 21:11
Git's Avatar
Git Git is offline
Old Git
 
Join Date: Mar 2002
Location: Torino
Posts: 1,116
Rept. Given: 220
Rept. Rcvd 265 Times in 157 Posts
Thanks Given: 109
Thanks Rcvd at 218 Times in 126 Posts
Git Reputation: 200-299 Git Reputation: 200-299 Git Reputation: 200-299
Frame troubles

I'm having trouble understanding what is happening in this code snippet. Quite a few of the Delphi procs start in a similar way with same two FS: statements

Code:
CODE:004BDE62 33 C0                      xor     eax, eax
CODE:004BDE64 55                          push    ebp
CODE:004BDE65 68 FF DE 4B 00             push    offset @@4
CODE:004BDE6A 64 FF 30                    push    dword ptr fs:[eax]
CODE:004BDE6D 64 89 20                    mov     fs:[eax], esp
...
CODE:004BDEFF E9 00 64 F4 FF       @4:    jmp     @HandleFinally
...

  v8 = &v15;
  v7 = v4BDEFF;
  v6 = __readfsdword(0);
  __writefsdword(0, (unsigned int)&v6);
...

In particular, what are the two statements involving FS doing and is there a way to make hexrays do a proper job of handling them?. Sorry for the dumb question, but this is the first time that I've had to look at FS.

Git
Reply With Quote
  #2  
Old 10-26-2012, 21:15
mm10121991 mm10121991 is offline
VIP
 
Join Date: Feb 2011
Posts: 136
Rept. Given: 29
Rept. Rcvd 56 Times in 34 Posts
Thanks Given: 7
Thanks Rcvd at 23 Times in 13 Posts
mm10121991 Reputation: 58
isn't this just setting a seh handler ??
Reply With Quote
  #3  
Old 10-26-2012, 22:45
deepzero's Avatar
deepzero deepzero is offline
VIP
 
Join Date: Mar 2010
Location: Germany
Posts: 307
Rept. Given: 114
Rept. Rcvd 64 Times in 42 Posts
Thanks Given: 186
Thanks Rcvd at 221 Times in 94 Posts
deepzero Reputation: 64
yes., because you zeroed eax with the xor.
olly would let you know via a comment...
Reply With Quote
  #4  
Old 10-26-2012, 23:22
Git's Avatar
Git Git is offline
Old Git
 
Join Date: Mar 2002
Location: Torino
Posts: 1,116
Rept. Given: 220
Rept. Rcvd 265 Times in 157 Posts
Thanks Given: 109
Thanks Rcvd at 218 Times in 126 Posts
Git Reputation: 200-299 Git Reputation: 200-299 Git Reputation: 200-299
Yes, I suspect it is some kind of exception handler. Is there any way to get hexrays to handle it more elegantly?

Git
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
CKInfo 1.14 Troubles IMJUSTADONKEY General Discussion 7 07-21-2024 20:21
Flexlm troubles Zigmund General Discussion 0 04-29-2003 14:51
Binding Troubles SLIM SLIM General Discussion 0 02-26-2003 05:05


All times are GMT +8. The time now is 17:56.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2025 )