NASM Forum > Programming with NASM

Use of XOR

<< < (2/2)

JohnG:
Hi all,

I think it might  be only one address (ebp) still not sure why you would do it.
EAX - ABB63DCD
EBP - 004FFB3C   (stack addr )

debs3759:
That doesn't make sense to me. It looks like some strange code generated by a compiler, but from your attached code I can't figure out what it is meant to do. Or the disassembler got something wrong, I haven't checked if it could be something else.

Frank Kotler:
Hi John,

Too cryptic for me!

Here is your file:

00132A9D      | A1 08501300          | mov     eax,dword ptr ds:[0x135008]                    |
00132AA2      | 3145 FC              | xor     dword ptr ss:[ebp-0x4],eax                     |
00132AA5      | 33C5                 | xor     eax,ebp                                        |
00132AA7      | 50                   | push    eax                                            |

It appears to be a disassembly... but not Nasm syntax!

What happens when you run it? What gets pushed? What do you do with it then? Print it? That would be too much to ask.I  suppose...

I think what is being XORed are contents of memory, not memory addresses.  That might help a little... but not much. Well... first load eax from a variable. Then xor that with... [ebp + 4] is probably a parameter passed to a subroutine. Then THAT is xored with ebp. Very strange!

I take it that you don't have source code? Commented source code would be really nice! Can you disassemble it with ndisasm? That will disassemble the executable header, too, which is a PITA. I like Agner Fog's "objconv" as a disassembler. It will produce Nasm syntax, and knows where the code starts!

That's not much help. Can you help us any more? Can we get this code? Can you Tell us what it does, overall?

Maybe more later,
Frank

Navigation

[0] Message Index

[*] Previous page