x86 Disassembly/Loop Examples

Example: Identify Purpose

What does this function do? What kinds of parameters does it take, and what kind of results (if any) does it return?

 push ebp
 mov ebp, esp
 mov esi, [ebp + 8]
 mov ebx, 0
 mov eax, 0
 mov ecx, 0
 _Label_1:
 mov ecx, [esi + ebx * 4]
 add eax, ecx
 inc ebx
 cmp ebx, 100
 jne _Label_1
 mov esp, ebp
 pop ebp
 ret 4

This function loops through an array of 4 byte integer values, pointed to by esi, and adds each entry. It returns the sum in eax. The only parameter (located in [ebp + 8]) is a pointer to an array of integer values. The comparison between ebx and 100 indicates that the input array has 100 entries in it. The pointer offset [esi + ebx * 4] shows that each entry in the array is 4 bytes wide.

Example: Complete C Prototype

What is this function's C prototype? Make sure to include parameters, return values, and calling convention.

 push ebp
 mov ebp, esp
 mov esi, [ebp + 8]
 mov ebx, 0
 mov eax, 0
 mov ecx, 0
 _Label_1:
 mov ecx, [esi + ebx * 4]
 add eax, ecx
 inc ebx
 cmp ebx, 100
 jne _Label_1
 mov esp, ebp
 pop ebp
 ret 4

Notice how the ret function cleans its parameter off the stack? That means that this function is an STDCALL function. We know that the function takes, as its only parameter, a pointer to an array of integers. We do not know, however, whether the integers are signed or unsigned, because the je command is used for both types of values. We can assume one or the other, and for simplicity, we can assume unsigned values (unsigned and signed values, in this function, will actually work the same way). We also know that the return value is a 4-byte integer value, of the same type as is found in the parameter array. Since the function doesnt have a name, we can just call it "MyFunction", and we can call the parameter "array" because it is an array. From this information, we can determine the following prototype in C:

 unsigned int STDCALL MyFunction(unsigned int *array);

Example: Decompile To C Code

Decompile this code into equivalent C source code.

 push ebp
 mov ebp, esp
 mov esi, [ebp + 8]
 mov ebx, 0
 mov eax, 0
 mov ecx, 0
 _Label_1:
 mov ecx, [esi + ebx * 4]
 add eax, ecx
 inc ebx
 cmp ebx, 100
 jne _Label_1
 mov esp, ebp
 pop ebp
 ret 4

Starting with the function prototype above, and the description of what this function does, we can start to write the C code for this function. We know that this function initializes eax, ebx, and ecx before the loop. However, we can see that ecx is being used as simply an intermediate storage location, receiving successive values from the array, and then being added to eax.

We will create two unsigned integer values, a (for eax) and b (for ebx). We will define both a and b with the register qualifier, so that we can instruct the compiler not to create space for them on the stack. For each loop iteration, we are adding the value of the array, at location ebx*4 to the running sum, eax. Converting this to our a and b variables, and using C syntax, we see:

 a = a + array[b];

The loop could be either a for loop, or a while loop. We see that the loop control variable, b, is initialized to 0 before the loop, and is incremented by 1 each loop iteration. The loop tests b against 100, after it gets incremented, so we know that b never equals 100 inside the loop body. Using these simple facts, we will write the loop in 3 different ways:

First, with a while loop.

 unsigned int STDCALL MyFunction(unsigned int *array)
 {
    register unsigned int b = 0;
    register unsigned int a = 0;
    while(b != 100)
    {
       a = a + array[b];
       b++;
    }
    return a;
 }

Or, with a for loop:

unsigned int STDCALL MyFunction(unsigned int *array)
 {
    register unsigned int b;
    register unsigned int a = 0;
    for(b = 0; b != 100; b++)
    {
       a = a + array[b];
    }
    return a;
 }

And finally, with a do-while loop:

unsigned int STDCALL MyFunction(unsigned int *array)
 {
    register unsigned int b = 0;
    register unsigned int a = 0;
    do
    {
       a = a + array[b];
       b++;
    }while(b != 100);
    return a;
 }