NTDebugging Puzzler 0x00000003 (Matrix Edition) Some assembly required.

NTDebugging Puzzler 0x00000003 (Matrix Edition) Some assembly required.

  • Comments 37

Hello NTdebuggers, I'm very impressed with the depth of the answers we are seeing from our readers.  As I stated in last week's response, this week's puzzler is going to be harder.  With that said let's take it up a notch.  One of the things that is really cool about be an Escalation Engineer in GES/CPR is how far we go in the pursuit of solving complex problems.  If we're debugging some Microsoft code in a kernel dump or user mode, and our quest takes us into a binary that we don't have code or symbols for, we don't stop, we forge on!  Over the years there are members of our team that have had to port to or support Alpha, PowerPC, MIPs, IA64 and x64, myself included.  As a result most of us have books for just about every mainstream processor under the sun.  It's a good idea if you're going to be debugging on these platforms to have general working knowledge the CPUs you will encounter.  The most common CPU's we deal with are x86, followed by x64 and IA64.  Microsoft doesn't support PPC, MIPS or Alpha anymore unless you're dealing with Xbox consoles, and those are PPC.  That said, this week's challenge is to tell us what the following assembly does.  You can tell us in C, or break it down and comment on the various sections. 

Some people like cross word puzzles, Most of us in GES/CPR love to esreveR reenignE assembler. Have FUN!


“I don’t even see the code anymore”  Cypher...

0:000> uf myfun
puzzler3!myfun [c:\source\puzzler\puzzler3\puzzler3\puzzler3.cpp @ 20]:
   20 00cc1480 55              push    ebp
   20 00cc1481 8bec            mov     ebp,esp
   20 00cc1483 81ecf0000000    sub     esp,0F0h
   20 00cc1489 53              push    ebx
   20 00cc148a 56              push    esi
   20 00cc148b 57              push    edi
   20 00cc148c 8dbd10ffffff    lea     edi,[ebp-0F0h]
   20 00cc1492 b93c000000      mov     ecx,3Ch
   20 00cc1497 b8cccccccc      mov     eax,0CCCCCCCCh
   20 00cc149c f3ab            rep stos dword ptr es:[edi]
   26 00cc149e 8b4508          mov     eax,dword ptr [ebp+8]
   26 00cc14a1 50              push    eax
   26 00cc14a2 e803fcffff      call    puzzler3!ILT+165(_strlen) (00cc10aa)
   26 00cc14a7 83c404          add     esp,4
   26 00cc14aa 8945e0          mov     dword ptr [ebp-20h],eax
   28 00cc14ad 8b45e0          mov     eax,dword ptr [ebp-20h]
   28 00cc14b0 8945f8          mov     dword ptr [ebp-8],eax
   28 00cc14b3 eb09            jmp     puzzler3!myfun+0x3e (00cc14be)
   28 00cc14b5 8b45f8          mov     eax,dword ptr [ebp-8]
   28 00cc14b8 83e801          sub     eax,1
   28 00cc14bb 8945f8          mov     dword ptr [ebp-8],eax
   28 00cc14be 837df800        cmp     dword ptr [ebp-8],0
   28 00cc14c2 7e60            jle     puzzler3!myfun+0xa4 (00cc1524)
   30 00cc14c4 c745ec00000000  mov     dword ptr [ebp-14h],0
   30 00cc14cb eb09            jmp     puzzler3!myfun+0x56 (00cc14d6)
   30 00cc14cd 8b45ec          mov     eax,dword ptr [ebp-14h]
   30 00cc14d0 83c001          add     eax,1
   30 00cc14d3 8945ec          mov     dword ptr [ebp-14h],eax
   30 00cc14d6 8b45f8          mov     eax,dword ptr [ebp-8]
   30 00cc14d9 83e801          sub     eax,1
   30 00cc14dc 3945ec          cmp     dword ptr [ebp-14h],eax
   30 00cc14df 7d41            jge     puzzler3!myfun+0xa2 (00cc1522)
   32 00cc14e1 8b4508          mov     eax,dword ptr [ebp+8]
   32 00cc14e4 0345ec          add     eax,dword ptr [ebp-14h]
   32 00cc14e7 0fbe08          movsx   ecx,byte ptr [eax]
   32 00cc14ea 8b5508          mov     edx,dword ptr [ebp+8]
   32 00cc14ed 0355ec          add     edx,dword ptr [ebp-14h]
   32 00cc14f0 0fbe4201        movsx   eax,byte ptr [edx+1]
   32 00cc14f4 3bc8            cmp     ecx,eax
   32 00cc14f6 7e28            jle     puzzler3!myfun+0xa0 (00cc1520)
   34 00cc14f8 8b4508          mov     eax,dword ptr [ebp+8]
   34 00cc14fb 0345ec          add     eax,dword ptr [ebp-14h]
   34 00cc14fe 8a08            mov     cl,byte ptr [eax]
   34 00cc1500 884dd7          mov     byte ptr [ebp-29h],cl
   35 00cc1503 8b4508          mov     eax,dword ptr [ebp+8]
   35 00cc1506 0345ec          add     eax,dword ptr [ebp-14h]
   35 00cc1509 8b4d08          mov     ecx,dword ptr [ebp+8]
   35 00cc150c 034dec          add     ecx,dword ptr [ebp-14h]
   35 00cc150f 8a5101          mov     dl,byte ptr [ecx+1]
   35 00cc1512 8810            mov     byte ptr [eax],dl
   36 00cc1514 8b4508          mov     eax,dword ptr [ebp+8]
   36 00cc1517 0345ec          add     eax,dword ptr [ebp-14h]
   36 00cc151a 8a4dd7          mov     cl,byte ptr [ebp-29h]
   36 00cc151d 884801          mov     byte ptr [eax+1],cl
   38 00cc1520 ebab            jmp     puzzler3!myfun+0x4d (00cc14cd)
   40 00cc1522 eb91            jmp     puzzler3!myfun+0x35 (00cc14b5)
   41 00cc1524 5f              pop     edi
   41 00cc1525 5e              pop     esi
   41 00cc1526 5b              pop     ebx
   41 00cc1527 81c4f0000000    add     esp,0F0h
   41 00cc152d 3bec            cmp     ebp,esp
   41 00cc152f e820fcffff      call    puzzler3!ILT+335(__RTC_CheckEsp) (00cc1154)
   41 00cc1534 8be5            mov     esp,ebp
   41 00cc1536 5d              pop     ebp
   41 00cc1537 c3              ret

Good luck, and happy debugging.

Jeff Dailey-

In response:  Wow, you folks did it again. I was worried that not many of our readers would respond.  Our entire team was very impressed with the number and quality of the responses we saw.  Congratulations goes out to all those assembler gurus out there that figured out this was a simple bubble sort.  We enjoyed seeing how various people went about solving this.  Some people compiled their code as they worked on reversing the function to verify the assembler.  This is a good approach.  Others just seemed to work it out end to end.  This is the approach I usually end up using because I’m typically in the middle of a debug and don’t actually need the source.


Great work!


Here is the answer….



void myfun(char *val)


00321480  push        ebp 

00321481  mov         ebp,esp

00321483  sub         esp,0F0h

00321489  push        ebx 

0032148A  push        esi 

0032148B  push        edi 

0032148C  lea         edi,[ebp-0F0h]

00321492  mov         ecx,3Ch

00321497  mov         eax,0CCCCCCCCh

0032149C  rep stos    dword ptr es:[edi]

       int i;

       int j;

       int len;

       char t;



0032149E  mov         eax,dword ptr [val]

003214A1  push        eax 

003214A2  call        @ILT+165(_strlen) (3210AAh)

003214A7  add         esp,4

003214AA  mov         dword ptr [len],eax


       for (i=len;i>0;i--)

003214AD  mov         eax,dword ptr [len]

003214B0  mov         dword ptr [i],eax

003214B3  jmp         myfun+3Eh (3214BEh)

003214B5  mov         eax,dword ptr [i]

003214B8  sub         eax,1

003214BB  mov         dword ptr [i],eax

003214BE  cmp         dword ptr [i],0

003214C2  jle         myfun+0A4h (321524h)



003214C4  mov         dword ptr [j],0

003214CB  jmp         myfun+56h (3214D6h)

003214CD  mov         eax,dword ptr [j]

003214D0  add         eax,1

003214D3  mov         dword ptr [j],eax

003214D6  mov         eax,dword ptr [i]

003214D9  sub         eax,1

003214DC  cmp         dword ptr [j],eax

003214DF  jge         myfun+0A2h (321522h)


                     if (val[j]>val[j+1])

003214E1  mov         eax,dword ptr [val]

003214E4  add         eax,dword ptr [j]

003214E7  movsx       ecx,byte ptr [eax]

003214EA  mov         edx,dword ptr [val]

003214ED  add         edx,dword ptr [j]

003214F0  movsx       eax,byte ptr [edx+1]

003214F4  cmp         ecx,eax

003214F6  jle         myfun+0A0h (321520h)



003214F8  mov         eax,dword ptr [val]

003214FB  add         eax,dword ptr [j]

003214FE  mov         cl,byte ptr [eax]

00321500  mov         byte ptr [t],cl


00321503  mov         eax,dword ptr [val]

00321506  add         eax,dword ptr [j]

00321509  mov         ecx,dword ptr [val]

0032150C  add         ecx,dword ptr [j]

0032150F  mov         dl,byte ptr [ecx+1]

00321512  mov         byte ptr [eax],dl


00321514  mov         eax,dword ptr [val]

00321517  add         eax,dword ptr [j]

0032151A  mov         cl,byte ptr [t]

0032151D  mov         byte ptr [eax+1],cl



00321520  jmp         myfun+4Dh (3214CDh)



00321522  jmp         myfun+35h (3214B5h)


00321524  pop         edi 

00321525  pop         esi 

00321526  pop         ebx 

00321527  add         esp,0F0h

0032152D  cmp         ebp,esp

0032152F  call        @ILT+335(__RTC_CheckEsp) (321154h)

00321534  mov         esp,ebp

00321536  pop         ebp 

00321537  ret         


Thank You

Jeff Dailey-

Leave a Comment
  • Please add 4 and 1 and type the answer here:
  • Post
  • How do you want to get the result of this? I have a C code which "almost" compiles to the same code. The stack locations for the automatic variables are not exactly the same, and sometimes, my compiler (MSVC6) uses different registers for the same thing.

    Should I post the code here?

  • Oh, it seems this blog is moderated? So, I believe it is correct to send the code directly:

    Here it is (and I hope the formatting will survive the posting here):

    #include <string.h>

    void myfun(char * p, int n)


       /* the stack layout is not exactly like the original */

       int i, j, k;

       char c;

       char buffer[160]; /*!< ununsed buffer */

       i = strlen(p);

       for ( j = i; j > 0; j-- )


           for ( k = 0; k < j; k++ )



                * Huh? Swap p[k] and p[k+1] if they are identical?

                * This does not make much sense, does it?


               if ( p[k] == p[k+1] )


                   c = p[k];

                   p[k] = p[k+1];

                   p[k+1] = c;





    Now, what sense does this code have? IMHO, there is no sense at all. It goes through the input buffer pointed to by p and exchanges consecutive characters if they are equal. Additionally, it proceeds multiple times through the buffer.

    There is no sense at all.

  • "Like a splinter in your mind" Morpheus

    It was a valuable exercise. I started by using an array instead of 4 local variables, and that added an extra call to _RTC_CheckStackVars.

    void myfun2(char *x) {

    int a, b, c;

    char d;

     c = strlen(x);

     a = c;

     for(;a > 0; a --) {

       b = 0;

       for(;b < a - 1; b ++) {

         if(x[b] > x[b + 1]) {

           d = x[b];

           x[b] = x[b + 1];

           x[b + 1] = d;





  • myfun( pstr pStrParam )


       // alphabetize pStrParam

       int nStrParamLength = strlen( pStrParam );

       for( int nStrParamCurrent = nStrParamLength; nStrParamCurrent > 0; nStrParamCurrent-- )

           for( int nStrParamIndex = 0; nStrParamCurrent - 1 < nStrParamIndex; ++nStrParamIndex )


               if( pStrParam[ nStrParamIndex ] > pStrParam[ nStrParamIndex + 1 ]  


                   char cCurrent = pStrParam[ nStrParamIndex ];    

                   pStrParam[ nStrParamIndex ] = pStrParam[ nStrParamIndex + 1 ];

                   pStrParam[ nStrParamIndex + 1 ] = cCurrent;





  • Here's the C code I reverse this into:

    #include <stdio.h>

    #include <tchar.h>

    #include <windows.h>

    void myfun(char *);

    int _tmain(int argc, _TCHAR* argv[])


     char * pszData[80];

     strcpy(pszData, "I don't even see the code anymore");

     printf("Before: %s\n", pszData);


     printf("After : %s\n", pszData);  


     return 0;


    void myfun(char * psz)


     char  ch;

     int   i;

     int   z1, z2;

     z1 = strlen(psz);

     for (z2=z1; z2 > 0; z2--)


       for (i=0; i < z2-1; i++)


         if (psz[i] > psz[i+1])


           ch        = psz[i];

           psz[i]    = psz[i+1];

           psz[i+1]  = ch;





    Which results in this:

    Before: I don't even see the code anymore

    After :       'Iacddeeeeeeehmnnnooorsttvy

    Basically, it in-place sorts the characters.

    Here another test:

    Before: AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz

    After : ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

    Now I wonder how Phoenix would have done...

  • I guess that the C++ code should be something like the following:

    void myfun(TCHAR * szString)


    int iCount;

    int iCount2;

    int iLen;

    TCHAR cApp;

    iLen = strlen(szString);

    for (iCount = iLen;iCount > 0;iCount--)


     for (iCount2 = 0;iCount2 < (iCount -1);iCount2++)


      if (szString[iCount2] > szString[iCount2 + 1])


       cApp = szString[iCount2];

       szString[iCount2] = szString[iCount2 + 1];

       szString[iCount2 + 1] = cApp;





    I think that the function should reverse the string passed as an agument.

    I think that there is an error, the line :

    if (szString[iCount2] > szString[iCount2 + 1])

    shuld be

    if (szString[iCount2] != szString[iCount2 + 1])

    In ASM  the Line

    32 00cc14f6 7e28            jle     puzzler3!myfun+0xa0 (00cc1520)

    Shuld be

    32 00cc14f6 7428            jz     puzzler3!myfun+0xa0 (00cc1520)


  • Oh... I read the JLE wrong. Yes, it makes more sense if the variables are not identical. ;) And there were some other "minor" errors.

    I must admit I undid the compilation in the train with paper and pencil. I might have spotted this error if I did it on the computer.

    And: I must tell that the debug build reveals much of the original structure.

    Anyway, I am still puzzled why the compiler generated this stack frame in this way. Is it because it is C++ and I missed something important? Is it any "anti-malware" aspect of the newer compilers?

Page 3 of 3 (37 items) 123