Printable View
Guys, I have been in a research of an MMORPG with no source code availability. I have used OllyDbg to look into the Machine Code, but unfortunately I am unable to analyze it. I have read many articles, but there were no detailed statement to statement guide that I came across.
I am attaching the Machine Code. If you have any idea about analyzing it, please post a brief note about it. Just tell me what is happening in the particular function:rolleyes:
"Can you please reverse this for me?"Quote:
Originally Posted by cvrdheeraj
1. Learn assembly, primarily IA-32.
2. Go learn how to reverse (many books).
3. "Give a man a fish, he'll eat for a day. Teach a man to fish and he'll eat for a lifetime."
Now go.
Well, I always like to learn new things, so if you have got any references for me, please let me know.:):Quote:
Originally Posted by jMerliN
The Art of Assembly Language is one good resource (google). I mean that's if you're not that familiar with machine code yet, as it unfortunately is required before you can begin learning reversing-related techniques.
I'm with jMerlin on this one, it's very little use to ask others to do something for you when you'll run into similar problems again and again later on.
Had a quick look at the code, pretty hard to say what it's really about without access to stack information and other data.
Very well, I have started learning the Assembly Code.
Additionally I would like to know if the above code is easy to read or not. Since it belongs to a big mmorpg, I am in a belief that it might be more difficult than expected. If it is indeed hard, then i will try to go more deeper into the subject.
I'm not sure what you mean by difficult to read. The code is mostly just about reading memory locations, something which is of no value to me as I don't have a clue about prior calls and other data. If you step through the area and constantly keep an eye on where the addresses point to, you should be able to get a picture. edit: of course, those CALL's may hold many more operations than this function alone.
This kind of blocks are usually a good hint about where there's indexing of an array of structures going on, and without other details a good guess would be there's a data structure of 140 bytes in size, and the code targets the one at index held by EAX. If you're lucky, the address held in ECX (at the end of this sequence), will actually point to the beginning of the array in the data section, and if you're super lucky, who knows you might be able to find some readable text there!
A few lines below this block EDX is used again, perhaps that's where they're indexing the inventory of the character pointed to in this block... or anything else similar.Code:AND EAX,0FF
IMUL EAX,EAX,140
MOV ECX,DWORD PTR SS:[EBP-4]
LEA EDX,DWORD PTR DS:[ECX+EAX+FB]
Good luck with reversing, it's great fun once you get into it! ;)
P.S. I'm not an expert in the field or anything, but usually a good rule of a thumb for myself is that if an executable is much more than a meg or two in size, it's probably too big to go through on my own and make anything sensible of it.