minesweeper in IDA

Started by
1 comment, last by mattd 14 years, 2 months ago
i'm currently doing a little practice with assembly with minesweeper opened up in IDA pro... im just curious as to why when u open programs up in IDA why does it randomly split up a part of a function with --------------------------------- for example this is a code in a function in minesweeper...why is it inside of a wall of minuses? what does this indicate? .text:01001E59 ; --------------------------------------------------------------------------- .text:01001E59 .text:01001E59 loc_1001E59: ; CODE XREF: sub_1001BC9+22Dj .text:01001E59 mov eax, [ebp+wParam] .text:01001E5C add eax, 0FFFFFDF7h .text:01001E61 mov word ptr dword_10056A0, ax .text:01001E67 movzx eax, ax .text:01001E6A lea eax, [eax+eax*2] .text:01001E6D shl eax, 2 .text:01001E70 mov ecx, dword_1005010[eax] .text:01001E76 mov dword_10056A4, ecx .text:01001E7C mov ecx, dword_1005014[eax] .text:01001E82 mov eax, dword_1005018[eax] .text:01001E88 mov uValue, ecx .text:01001E8E mov dword_10056AC, eax .text:01001E93 call sub_100367A .text:01001E98 jmp loc_1001F4A .text:01001E9D ; --------------------------------------------------------------------------- .text:01001E9D
Advertisement
; (semicolon) typically means a comment in assemblers.
;------etc just serves as a separator, nothing special.
code code code
code code code
code code code
;------------------------------------------------------
The dashed line comments split up maximally-sized chunks of contiguous instructions, i.e. instructions which can be executed one after the other. (Note that control can still jump out of these blocks, i.e. with a conditional jump)

In your example, note the last instruction (at 0x01001E98) is a jmp. Hence control will always jump elsewhere at this point. Therefore this is the end of this particular chunk, and is so marked.

The other kind of separator you will notice is the more obvious:
; =============== S U B R O U T I N E =======================================

This marks the start of (what IDA thinks corresponds to) a function in the original source.

This topic is closed to new replies.

Advertisement