Sign in to follow this  
nuclear123

minesweeper in IDA

Recommended Posts

nuclear123    119
i'm currently doing a little practice with assembly with minesweeper opened up in IDA pro... im just curious as to why when u open programs up in IDA why does it randomly split up a part of a function with --------------------------------- for example this is a code in a function in minesweeper...why is it inside of a wall of minuses? what does this indicate? .text:01001E59 ; --------------------------------------------------------------------------- .text:01001E59 .text:01001E59 loc_1001E59: ; CODE XREF: sub_1001BC9+22Dj .text:01001E59 mov eax, [ebp+wParam] .text:01001E5C add eax, 0FFFFFDF7h .text:01001E61 mov word ptr dword_10056A0, ax .text:01001E67 movzx eax, ax .text:01001E6A lea eax, [eax+eax*2] .text:01001E6D shl eax, 2 .text:01001E70 mov ecx, dword_1005010[eax] .text:01001E76 mov dword_10056A4, ecx .text:01001E7C mov ecx, dword_1005014[eax] .text:01001E82 mov eax, dword_1005018[eax] .text:01001E88 mov uValue, ecx .text:01001E8E mov dword_10056AC, eax .text:01001E93 call sub_100367A .text:01001E98 jmp loc_1001F4A .text:01001E9D ; --------------------------------------------------------------------------- .text:01001E9D

Share this post


Link to post
Share on other sites
clashie    632
; (semicolon) typically means a comment in assemblers.
;------etc just serves as a separator, nothing special.
code code code
code code code
code code code
;------------------------------------------------------

Share this post


Link to post
Share on other sites
mattd    1078
The dashed line comments split up maximally-sized chunks of contiguous instructions, i.e. instructions which can be executed one after the other. (Note that control can still jump out of these blocks, i.e. with a conditional jump)

In your example, note the last instruction (at 0x01001E98) is a jmp. Hence control will always jump elsewhere at this point. Therefore this is the end of this particular chunk, and is so marked.

The other kind of separator you will notice is the more obvious:
; =============== S U B R O U T I N E =======================================

This marks the start of (what IDA thinks corresponds to) a function in the original source.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this