2

This might be obvious, but I'm baffled.. I opened a random .so library to poke around and learn IDA a bit better, and I hit something I've never seen. IDA has these instructions:

mov     eax, [esp+4Ch+ptr]
mov     dword ptr [eax], 665F6165h
mov     dword ptr [eax+4], 6C615F66h
mov     dword ptr [eax+8], 3A776F6Ch
mov     dword ptr [eax+0Ch], 61736964h
mov     dword ptr [eax+10h], 64656C62h
mov     byte ptr [eax+14h], 0Ah

My guess is it's building some sort of struct, but it's moving dwords from addresses that don't exist in the binary (I think). When I try to jump to address 0x665F6165 for example, JumpAsk fails, which makes sense, since the hex view ends at 009636A0.. What are these weird addresses? Where are they coming from?

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
XeroxDucati
  • 215
  • 1
  • 10

1 Answers1

0

Have it displayed as characters by hitting r (R) on the keyboard "over" each of those 32-bit constants.

You should get four byte character literals for it, probably showing some ASCII values (and for Little Endian in apparent reverse order), similar to this:

mov     eax, [esp+4Ch+ptr]
mov     dword ptr [eax], 'ea_f' ; 665F6165h
mov     dword ptr [eax+4], 'f_al' ; 6C615F66h
mov     dword ptr [eax+8], 'low:' ; 3A776F6Ch
mov     dword ptr [eax+0Ch], 'disa' ; 61736964h
mov     dword ptr [eax+10h], 'bled' ; 64656C62h
mov     byte ptr [eax+14h], '\n' ; 0Ah

Looks like an inlined memcpy (or strcpy) or memmove as a compiler would produce it during optimizations for string literals.

Btw: this is called stack strings (there are further links from my Q&A). At some point you will develop a sixth sense for this sort of thing and will probably automatically try r to see if it yields something if the values look like ASCII.

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
  • Well, you're right.. Actually all 5 MOVs apparently are moving one string -- one dword at a time, so I suspect you're right about the inlining.. I guess the question then becomes, why doesn't IDA automatically figure that out? Is there a way to get it to analyze and reverse the optimizations? – XeroxDucati Jan 17 '23 at 14:26
  • Uhm yes, in the links that I included, you'd have found that there is an IDAPython plugin to deal with stack string: https://github.com/mandiant/flare-ida ... other than that, please ask a separate question (you may well link to this one for reference), but changing the subject of a question after getting an answer isn't good style. Thanks. (PS: While you can probably attempt to find patterns and handle these from a script or plugin, reversing optimizations to grasp the idea behind a given piece of code is exactly one of the big challenges every reverse engineer faces.) – 0xC0000022L Jan 17 '23 at 15:08
  • 1
    I missed that there was a second link.. D'oh. Thanks so much! – XeroxDucati Jan 17 '23 at 15:11