x86 asm strange Array for loop

Question

I can't quite makes sense of this code. It seems like a for loop iterating through an array of structs. But it keeps overwriting itself as the index does not jump far enough.

                xor     edx, edx
                db      66h, 66h, 66h, 66h
                nop     word ptr cs:[eax+eax+00000000h]
loc_1808450:
                mov     esi, [eax+312]
                mov     esi, [esi+edx*4]
                mov     dword ptr [esi+12], 0
                movsd   xmm0, qword ptr ds:(loc_180815C - 180815Ch)[ecx]
                movsd   qword ptr [esi+4], xmm0
                mov     byte ptr [esi+64], 0
                mov     byte ptr [esi+82], 0
                mov     byte ptr [esi+65], 0
                mov     dword ptr [esi+40], 0
                mov     dword ptr [esi+44], 0
                mov     dword ptr [esi+48], 0
                mov     byte ptr [esi+66], 0FFh
                mov     dword ptr [esi+16], 0
                mov     dword ptr [esi+71], 0
                mov     dword ptr [esi+67], 0
                mov     byte ptr [esi+81], 0
                mov     word ptr [esi+79], 0
                mov     dword ptr [esi+75], 0
                mov     dword ptr [esi+87], 0
                mov     dword ptr [esi+83], 0
                mov     word ptr [esi+95], 0
                mov     dword ptr [esi+91], 0
                mov     byte ptr [esi+98], 100
                mov     byte ptr [esi+97], 100
                mov     byte ptr [esi+99], 0
                mov     byte ptr [esi+100], 0
                mov     byte ptr [esi+101], 0
                mov     dword ptr [esi+20], 0FFFFFFFFh
                mov     dword ptr [esi+24], 0FFFFFFFFh
                mov     dword ptr [esi+36], 0
                mov     dword ptr [esi+28], 0
                mov     dword ptr [esi+32], 0
                mov     dword ptr [esi+56], 0
                mov     dword ptr [esi+52], 0
                mov     dword ptr [esi+60], 0
                mov     dword ptr [esi+106], 0
                mov     dword ptr [esi+102], 0
                mov     dword ptr [esi+114], 0
                mov     dword ptr [esi+110], 0
                mov     byte ptr [esi+118], 0
                inc     edx
                cmp     edx, 23
                jnz     loc_1808450

This is what I understand from the code:

mov esi, [esi+edx*4] seems to set the array and inc edx the update i++

The array is of size 119 and i*4 will never be a big enough memory jump so it ends up overriding the value in movsd xmm0, qword ptr ds:(loc_180815C - 180815Ch)[ecx]

I don’t know how you think the value in EDX, 119 or the movsd relate to each other. EDX is used as an index to get a pointer to memory somewhere. It’s not given how much memory there is, but it might very well have 119 bytes per pointer. — Sami Kuhmonen
Sorry I am still new at this. I haven't touched c++ in like 10 years so my pointer assumptions might be very flawed. — Sinister Mephisto

Afshin Afshin · Accepted Answer · 2018-03-23T14:16:13

This code initialize an array of 23 item pointers.

mov esi, [eax+312]

Here esi is start of an array of points and here:

mov esi, [esi+edx*4]

esi is a pointer. You are missing [] operator. esi+edx*4 shows an address of a pointer and value of this pointer goes to esi. That edx*4 is for getting next pointer to object, not object itself. Now this will be initialized. Real code should be something like this (there is no call in your assembly I just wrote like this for simplicity):

struct _mystruct *arr[23];

void init_struct(struct _mystruct *item)
{
    ...
}

for (int i=0; i < 23; i++)
    init_struct(arr[i]));

x86 asm strange Array for loop

1 Answers