Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x86_32 debugger shows .string directive instead of mov dword [ebp-0x30], eax #4517

Open
gogo2464 opened this issue May 25, 2024 · 2 comments
Labels
disassembly waiting-for-author Used to mark PRs where more work is needed X86

Comments

@gogo2464
Copy link
Contributor

Work environment

Questions Answers
OS/arch/bits (mandatory) windows
File format of the file you reverse (mandatory) PZ
Architecture/bits of the file (mandatory) x32
rizin -v full output, not truncated (mandatory) rizin.exe -v
rizin 0.8.0 @ windows-x86-32
commit: 416fc1e

Expected behavior

Actual behavior

Steps to reproduce the behavior

            ;-- eip:
            0x00ba1050      e825010000     call  0xba117a              ;[2]
            ;-- str.i___iEiBY:
            0x00ba1055     .string "i\xc3\xa1}iEiBY\xc3" ; len=10
            0x00ba105f      0000           add   byte [eax], al
            0x00ba1061      e870010000     call  0xba11d6

instead of showing

	
	mov dword [ebp-0x30], eax
	
	mov ebp, eax
	mov edx, eax

Additional Logs, screenshots, source code, configuration dump, ...

Drag and drop zip archives containing the Additional info here, don't use external services or link.

@TheN00bBuilder
Copy link
Contributor

Do you have the byte sequence that causes this? I don't see how the assembly specified in the question could create the output.

@DMaroo
Copy link
Member

DMaroo commented Jun 25, 2024

Can you provide an example executable where you face this issue? I don't believe that it is a problem with just the disassembler since the following works.

$ rz-asm -a x86 -b 32 -d $(rz-asm -a x86 -b 32 "mov dword [ebp-0x30], eax")
mov dword [ebp - 0x30], eax

So the issue may be with the offset at which the disassembly is done. We can't fix this without you providing us with a minimal working example demonstrating this bug.

@DMaroo DMaroo added X86 waiting-for-author Used to mark PRs where more work is needed disassembly labels Jun 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
disassembly waiting-for-author Used to mark PRs where more work is needed X86
Projects
None yet
Development

No branches or pull requests

3 participants