Printing Registers Value. What these values mean?

Index > Windows > Printing Registers Value. What these values mean?

Author

Thread

fasmnewbie

Joined: 01 Mar 2011
Posts: 555

fasmnewbie

Hi people.

Out of curiosity, I developed a program that prints the content of the registers. I am on Intel Atom, WinXP SP3.

My questions are;
1. Are the values printed were the real content of the registers or just some random values? how to make sure?
2. Why is it my test line 'mov eax,5' seems not affecting the value of EAX.
3. Do I have to push/pop the registers so that I can get the most current content of the registers?
4. Can't seem to find how to print the EIP.

Code:

format PE console
include 'win32ax.inc'
entry main

macro DumpRegs
{
        mov dword [regEAX], eax
        mov dword [regEBX], ebx
        mov dword [regECX], ecx
        mov dword [regEDX], edx

        mov dword [regEDI], edi
        mov dword [regESI], esi
        mov dword [regEBP], ebp
        mov dword [regESP], esp

        mov word [regCS], cs
        mov word [regDS], ds
        mov word [regSS], ss
}
macro PrintRegs
{
        invoke printf, prtGP
        invoke printf, prtID
        invoke printf, prtSG
}
macro newline { invoke printf, prtnl }

section '.code' code executable readable
main:

;pushad
;push cs
;push ds
;push ss

DumpRegs
PrintRegs
invoke system, halt
newline

DumpRegs
PrintRegs
invoke system, halt
newline

DumpRegs
mov eax, 5      ;test
PrintRegs
invoke system, halt
newline

;popad
invoke exit, 0

section '.data' data readable writable

halt db "pause>null",0
regEAX dd ?
regEBX dd ?
regECX dd ?
regEDX dd ?
regESI dd ?
regEDI dd ?
regEBP dd ?
regESP dd ?
regCS dw ?
regDS dw ?
regSS dw ?

prtGP db "EAX:%08X ","EBX:%08X ","ECX:%08X ","EDX:%08X ",\
      0dh,0ah,0
prtID db "ESI:%08X ","EDI:%08X ","EBP:%08X ","ESP:%08X ",\
      0dh,0ah,0
prtSG db " CS:%08X "," DS:%08X "," SS:%08X ", 0dh,0ah,0
prtnl db 0dh,0ah,0

section '.idata' import data readable
library msvcrt, 'msvcrt.dll'
import msvcrt,\
system, 'system',\
printf, 'printf',\
exit, 'exit'

Thank you in advance for your advice and comments.

27 Apr 2011, 13:35

JohnFound

Joined: 16 Jun 2003
Posts: 3502
Location: Bulgaria

JohnFound

I am not very sure how "printf" works, but I can't see how the values from variables "regEAX".... etc. are read and displayed by printf. There is no reference to these variables in the invoke clause of printf.

27 Apr 2011, 14:05

fasmnewbie

Joined: 01 Mar 2011
Posts: 555

fasmnewbie

JohnFound wrote:

I am not very sure how "printf" works, but I can't see how the values from variables "regEAX".... etc. are read and displayed by printf. There is no reference to these variables in the invoke clause of printf.

Oops, my bad. Actually I used my old example. Thank you for that!
here is how the macro PrintRegs looks like

Code:

 macro PrintRegs
{
        invoke printf, prtGP, regEAX, regEBX, regECX, regEDX
        invoke printf, prtID, regEDI, regESI, regEBP, regESP
        invoke printf, prtSG, regCS, regDS, regSS
}

Thank you.

27 Apr 2011, 14:24

typedef

Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000

typedef

use ccall for printf not invoke, also for formatting try using unsigned int format specifier : %u.
enclose the dw/dd variables in square brackets when passing them to printf also.

27 Apr 2011, 14:48

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17658
Location: In your JS exploiting you and your system

revolution

typedef wrote:

use ccall for printf not invoke ...

No, use cinvoke for printf.

27 Apr 2011, 14:57

DOS386

Joined: 08 Dec 2006
Posts: 1901

DOS386

> 1. Are the values printed were the real content of the registers

YES (but they are neither too global nor too persistent Wink

)

> Can't seem to find how to print the EIP

Code:

    call @ff
@@: pope eax
    mov  dword [regEIP], eax

Code:

    call @ff
@@: pope dword [regEIP]

_________________
Bug Nr.: 12345

Title: Hello World program compiles to 100 KB !!!

Status: Closed: NOT a Bug

06 May 2011, 01:39

Fred

Joined: 22 Oct 2010
Posts: 39

Fred

I tried this, and it's pretty neat now that I got it to work. One thing though... is it possible to show reg values as floats? Changing %u to %f only prints zeroes, not really sure what's wrong, or if it's even supposed to work. Razz

04 Jul 2011, 12:22

Picnic

Joined: 05 May 2007
Posts: 1288
Location: Paradise Falls

Picnic

fasmnewbie wrote:

Why is it my test line 'mov eax,5' seems not affecting the value of EAX.

Hi,

Check out these examples.

http://board.flatassembler.net/topic.php?p=13916#13916
http://board.flatassembler.net/topic.php?t=10183
http://board.flatassembler.net/topic.php?p=68658#68658 (DOS)

Fred wrote:

is it possible to show reg values as floats?

Try this way Fred,

Code:

proc printfloat reg

        locals
            fmt db "%.2f",0
            ans dq 0.0
        endl

        pushad

        lea edx, [fmt]
        fild dword [reg]
        fstp qword [ans]
        cinvoke printf, edx, double [ans]

        popad
        ret

endp

[edit]polishing code a bit[/edit]

Last edited by Picnic on 04 Jul 2011, 19:11; edited 1 time in total

04 Jul 2011, 14:15

Fred

Joined: 22 Oct 2010
Posts: 39

Fred

That worked, thanks. Very Happy

Why the qword?

Edit: I also realized that I really wanted to do something else. Razz

I have a file that I load which contains floats. For example, 0.86599994 is stored as 2C B2 5D 3Fh. How do I get these "back to floats"? Do I have to convert them or is it simpler than that?

04 Jul 2011, 15:53

Picnic

Joined: 05 May 2007
Posts: 1288
Location: Paradise Falls

Picnic

It should be qword, printf f format requires 2 dwords.

04 Jul 2011, 20:24

Fred

Joined: 22 Oct 2010
Posts: 39

Fred

Aha, ok.

Knowing this, I solved my problem:

Code:

mov eax,[hstats]
movss xmm0,[eax+136]
cvtss2sd xmm0,xmm0
movsd [reg],xmm0

cinvoke printf,usefloat,double [reg]

Where hstats is a pointer to some file data. Probably not the best solution, but hey, it works, haha. Razz

04 Jul 2011, 21:14

garystampa

Joined: 25 May 2011
Posts: 52
Location: Central FLorida

garystampa

Hopefully they're not "random" values. Smile

But your program will affect what's in the registers.

05 Jul 2011, 11:44

typedef

Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000

typedef

...1 year later...

garystampa resurrected an old post...lol Very Happy

05 Jul 2011, 22:28

asmMe

Joined: 14 Jun 2011
Posts: 18

asmMe

Considering the fact that the OP only joined in March this year typedef, you may perhaps be looking at join dates and not post dates Rolling Eyes

18 Jul 2011, 13:33

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum