Author Topic: What's doing this assembly code?  (Read 6367 times)

Offline alexmalex021

  • Jr. Member
  • *
  • Posts: 3
What's doing this assembly code?
« on: October 25, 2015, 11:52:16 AM »
Hi all,

Could anyone help me to understand this code?

* this code used in a C program and some variables is from C.

Regards
« Last Edit: October 25, 2015, 12:19:12 PM by alexmalex021 »

Offline Frank Kotler

  • NASM Developer
  • Hero Member
  • *****
  • Posts: 2667
  • Country: us
Re: What's doing this assembly code?
« Reply #1 on: October 25, 2015, 05:41:53 PM »
Dunno. Where'd you find it?

Best,
Frank


Offline alexmalex021

  • Jr. Member
  • *
  • Posts: 3
Re: What's doing this assembly code?
« Reply #2 on: October 26, 2015, 07:10:42 AM »
Is it important?! a place in the web

Offline Frank Kotler

  • NASM Developer
  • Hero Member
  • *****
  • Posts: 2667
  • Country: us
Re: What's doing this assembly code?
« Reply #3 on: October 26, 2015, 08:48:30 AM »
No. I see...
Code: [Select]
; incbin "ps"
... but it's commented out. That would be the Unix utility, I suppose? (lists PIDs) It makes itself position independent... so it can be pasted into some other code instead of being run "on purpose". It forks itself. At this point, I'm confused. After a fork, you're "two places at once" and you look at eax to see if you're parent or child, but this code looks at edx - apparently for that purpose. Things are different on a Mac, I guess. Anyway, then it sys_execve's its "file" - which is Mac's "launch demon", I guess.  It seems to open that file and read it to where "ps" was commented out from, too(?). Then the other branch of the fork looks like it jumps back to someplace involving a magic number and "start"(?). I'm pretty confused by this point, but it looks like it intends to run code on somebody's machine without their knowledge or permission. I just wondered whether you were doing it to somebody or somebody was doing it to you. Or maybe I'm just being paranoid.

Best,
Frank


Offline alexmalex021

  • Jr. Member
  • *
  • Posts: 3
Re: What's doing this assembly code?
« Reply #4 on: October 26, 2015, 10:59:55 AM »
Thank you Frank.

My friend give me that assembly code.i cannot completely understand  the code.

This assembly code used in a C++ program.that is part of a complete program.

I still cannot understand that code exactly what's doing!
« Last Edit: October 26, 2015, 11:19:59 AM by alexmalex021 »