flat assembler
Message board for the users of flat assembler.

Index > Windows > Printing Registers Value. What these values mean?

Author
Thread Post new topic Reply to topic
fasmnewbie



Joined: 01 Mar 2011
Posts: 553
fasmnewbie
Hi people.

Out of curiosity, I developed a program that prints the content of the registers. I am on Intel Atom, WinXP SP3.

My questions are;
1. Are the values printed were the real content of the registers or just some random values? how to make sure?
2. Why is it my test line 'mov eax,5' seems not affecting the value of EAX.
3. Do I have to push/pop the registers so that I can get the most current content of the registers?
4. Can't seem to find how to print the EIP.

Code:
format PE console
include 'win32ax.inc'
entry main

macro DumpRegs
{
        mov dword [regEAX], eax
        mov dword [regEBX], ebx
        mov dword [regECX], ecx
        mov dword [regEDX], edx

        mov dword [regEDI], edi
        mov dword [regESI], esi
        mov dword [regEBP], ebp
        mov dword [regESP], esp

        mov word [regCS], cs
        mov word [regDS], ds
        mov word [regSS], ss
}
macro PrintRegs
{
        invoke printf, prtGP
        invoke printf, prtID
        invoke printf, prtSG
}
macro newline { invoke printf, prtnl }

section '.code' code executable readable
main:

;pushad
;push cs
;push ds
;push ss

DumpRegs
PrintRegs
invoke system, halt
newline

DumpRegs
PrintRegs
invoke system, halt
newline

DumpRegs
mov eax, 5      ;test
PrintRegs
invoke system, halt
newline

;popad
invoke exit, 0

section '.data' data readable writable

halt db "pause>null",0
regEAX dd ?
regEBX dd ?
regECX dd ?
regEDX dd ?
regESI dd ?
regEDI dd ?
regEBP dd ?
regESP dd ?
regCS dw ?
regDS dw ?
regSS dw ?

prtGP db "EAX:%08X ","EBX:%08X ","ECX:%08X ","EDX:%08X ",\
      0dh,0ah,0
prtID db "ESI:%08X ","EDI:%08X ","EBP:%08X ","ESP:%08X ",\
      0dh,0ah,0
prtSG db " CS:%08X "," DS:%08X "," SS:%08X ", 0dh,0ah,0
prtnl db 0dh,0ah,0

section '.idata' import data readable
library msvcrt, 'msvcrt.dll'
import msvcrt,\
system, 'system',\
printf, 'printf',\
exit, 'exit'
    


Thank you in advance for your advice and comments.
Post 27 Apr 2011, 13:35
View user's profile Send private message Visit poster's website Reply with quote
JohnFound



Joined: 16 Jun 2003
Posts: 3500
Location: Bulgaria
JohnFound
I am not very sure how "printf" works, but I can't see how the values from variables "regEAX".... etc. are read and displayed by printf. There is no reference to these variables in the invoke clause of printf.
Post 27 Apr 2011, 14:05
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
fasmnewbie



Joined: 01 Mar 2011
Posts: 553
fasmnewbie
JohnFound wrote:
I am not very sure how "printf" works, but I can't see how the values from variables "regEAX".... etc. are read and displayed by printf. There is no reference to these variables in the invoke clause of printf.


Oops, my bad. Actually I used my old example. Thank you for that!
here is how the macro PrintRegs looks like

Code:
 macro PrintRegs
{
        invoke printf, prtGP, regEAX, regEBX, regECX, regEDX
        invoke printf, prtID, regEDI, regESI, regEBP, regESP
        invoke printf, prtSG, regCS, regDS, regSS
}
    


Thank you.
Post 27 Apr 2011, 14:24
View user's profile Send private message Visit poster's website Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
use ccall for printf not invoke, also for formatting try using unsigned int format specifier : %u.
enclose the dw/dd variables in square brackets when passing them to printf also.
Post 27 Apr 2011, 14:48
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17250
Location: In your JS exploiting you and your system
revolution
typedef wrote:
use ccall for printf not invoke ...
No, use cinvoke for printf.
Post 27 Apr 2011, 14:57
View user's profile Send private message Visit poster's website Reply with quote
DOS386



Joined: 08 Dec 2006
Posts: 1901
DOS386
> 1. Are the values printed were the real content of the registers

YES (but they are neither too global nor too persistent Wink )

> Can't seem to find how to print the EIP

Code:
    call @ff
@@: pope eax
    mov  dword [regEIP], eax
    


Code:
    call @ff
@@: pope dword [regEIP]
    

_________________
Bug Nr.: 12345

Title: Hello World program compiles to 100 KB !!!

Status: Closed: NOT a Bug
Post 06 May 2011, 01:39
View user's profile Send private message Reply with quote
Fred



Joined: 22 Oct 2010
Posts: 39
Fred
I tried this, and it's pretty neat now that I got it to work. One thing though... is it possible to show reg values as floats? Changing %u to %f only prints zeroes, not really sure what's wrong, or if it's even supposed to work. Razz
Post 04 Jul 2011, 12:22
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1288
Location: behind the arc
Picnic
fasmnewbie wrote:

Why is it my test line 'mov eax,5' seems not affecting the value of EAX.

Hi,

Check out these examples.

http://board.flatassembler.net/topic.php?p=13916#13916
http://board.flatassembler.net/topic.php?t=10183
http://board.flatassembler.net/topic.php?p=68658#68658 (DOS)


Fred wrote:
is it possible to show reg values as floats?


Try this way Fred,
Code:
proc printfloat reg

        locals
            fmt db "%.2f",0
            ans dq 0.0
        endl

        pushad

        lea edx, [fmt]
        fild dword [reg]
        fstp qword [ans]
        cinvoke printf, edx, double [ans]

        popad
        ret

endp                     
    


[edit]polishing code a bit[/edit]


Last edited by Picnic on 04 Jul 2011, 19:11; edited 1 time in total
Post 04 Jul 2011, 14:15
View user's profile Send private message Reply with quote
Fred



Joined: 22 Oct 2010
Posts: 39
Fred
That worked, thanks. Very Happy

Why the qword?


Edit: I also realized that I really wanted to do something else. Razz
I have a file that I load which contains floats. For example, 0.86599994 is stored as 2C B2 5D 3Fh. How do I get these "back to floats"? Do I have to convert them or is it simpler than that?
Post 04 Jul 2011, 15:53
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1288
Location: behind the arc
Picnic
It should be qword, printf f format requires 2 dwords.
Post 04 Jul 2011, 20:24
View user's profile Send private message Reply with quote
Fred



Joined: 22 Oct 2010
Posts: 39
Fred
Aha, ok.

Knowing this, I solved my problem:

Code:
mov eax,[hstats]
movss xmm0,[eax+136]
cvtss2sd xmm0,xmm0
movsd [reg],xmm0

cinvoke printf,usefloat,double [reg]      


Where hstats is a pointer to some file data. Probably not the best solution, but hey, it works, haha. Razz
Post 04 Jul 2011, 21:14
View user's profile Send private message Reply with quote
garystampa



Joined: 25 May 2011
Posts: 52
Location: Central FLorida
garystampa
Hopefully they're not "random" values. Smile But your program will affect what's in the registers.
Post 05 Jul 2011, 11:44
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
...1 year later...

garystampa resurrected an old post...lol Very Happy
Post 05 Jul 2011, 22:28
View user's profile Send private message Reply with quote
asmMe



Joined: 14 Jun 2011
Posts: 18
asmMe
Considering the fact that the OP only joined in March this year typedef, you may perhaps be looking at join dates and not post dates Rolling Eyes
Post 18 Jul 2011, 13:33
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.