Hello, this is Dr. Miller and this
is Episode fourteen point fifteen of
Assembly.
Today, we're going to talk about
strings and see in assembly,
we're going to talk about how they
can be on the stack in the data
business section and then on
the heap.
So strings.
So see, strings allows
us to store an array
of characters and see
allows us to store them in several
different ways.
So, for example, they could be
within a function, they could be
defined statically, they could
be done using mallock.
But one of the restrictions on
strings is the printable characters
use the lowest seven bits.
So they're all also very easy
to find typically.
And then we have a zero that is our
null Terminator.
So strings on the stack.
So when you define a string
inside of a function using the
brackets, that is going to put it
on the stack and then we have
two different types, one where we
give the size, the other one, we
allow the compiler to figure out how
big it is.
So when we look at these inside of
our dissembler, we're going to see
that they get converted directly
into numbers and we can see
that they end up getting pushed onto
the stack or using a move.
And so we can see a bunch of
numbers that get moved into
those areas. And so those actually
represent the characters.
Now, the compiler explorer doesn't
try and decipher these.
And so that makes it a little bit
difficult to try and
see what they're doing.
But if we take a side by side look
and we use a an
actual reverse engineering tool,
we can actually. Right.
Click on these and turn them from
numbers into the actual character
values so you can see hello here
and then hello, their class
so we can see them in a dissembler
in the way that they are being
represented.
This is kind of just showing us
the raw data that's inside of their.
So strings in the data section,
so if you declare something as
static or outside of the main,
then that's going to automatically
put those strings into the data
section.
And so when we look at it, we can
see this is, again, another
disassembly. This is Ida and
we can see Y and
Z inside of here.
It's kind of showing us that this is
Dr. Miller. It's also actually
showing me the string percent s,
which is inside of that function.
And so if we try and look at those
inside of just a regular
disassembly, we're just going to see
actual addresses that are
on the stack.
And so it might be hard in order to
understand exactly what's
at those addresses unless you print
them off.
And again, we can jump to the
dissembler and we can see
that in the data section, we
can see our strings.
So there's Dr. Miller,
there's why which had I believe in
a which was sixty one
and Hecks.
And so we will actually see those
located in the data section and not
put onto the stack.
And then if we have an unknown
initialized buffer so we can see
that we give it a size, but we don't
put any data in it.
And so this is an unknown initialize
buffer.
So, again, we throw that in there
and we're going to see that we get
offset of Buffer as
what the data gets moved into it.
And so then if we go and look at
the offset of the buffer, we're
going to see that that's in the box.
So it's an initialize so the
compiler doesn't know what's there.
So the dissembler
doesn't know what's there.
And so it puts a question mark since
I don't really know what's here.
It depends on the loader
and the OS, what gets there.
And then in a disassembly, you can
kind of compact that and you can.
Right. Click on it and say, by the
way, this is an array.
And then it turns that array size
into hex.
And then it shows us that it's a
dupe or it's the same thing.
Questionmark over and over again for
all of that data.
And then we have strings using
malac, so here
we are making the function called to
mallock, it's allocating
one hundred characters for that
and then we're going to see some
Sterckx that's on top of that.
And again, this is to point out how
the compiler will actually
take functions and use them.
And so here we can see the call to
Mallik and then we can see that we
copy that into VARE 14 and
then VARE 14 or
EBP minus C ends
up being used in a lot of different
places. Again, I went through
the disassembly and I corrected
all of these. And so we actually
end up seeing that this
call to Sterk that actually
ends up being a repeat, not equal.
And so it sets up the string
functions with the ISI and Eddi
and then copies the data
into those locations.
And so sometimes you might put it
in a function, but the disassembly
will actually create something
completely different.
And so we see that for all of
these, where it's copying the data
from one location
into another.
And so that can make it difficult
in order to understand exactly
what's going on if
you're not used to reading that type
of code.
So today, we talked about some of
the different ways that we can
have strings in NC and
how those manifest themselves in
assembly, we looked at example
on the stack. We looked at one that
was in the data or the business
section, and then we looked at one
on the heap using Mallick.
In the future, we're going to look
at some other data types and see how
they manifest themselves
in sea and then the corresponding
versions in assembly.
If you have questions, you can email
me, Miller, MJF, you and KSTU,
and you can find me on Twitter at
Milhouse 30.