Last active
August 29, 2015 14:06
-
-
Save iagox86/e8b54e76c5eaa8ddb4b2 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"name": "strrchr example", | |
"labels": [ | |
{ | |
"name": "start", | |
"offset": "0x0" | |
}, | |
{ | |
"name": "loc1", | |
"offset": "0x17" | |
}, | |
{ | |
"name": "loc2", | |
"offset": "0x22" | |
}, | |
{ | |
"name": "loc3", | |
"offset": "0x2e" | |
}, | |
{ | |
"name": "loc4", | |
"offset": "0x30" | |
} | |
], | |
"segments": [ | |
{ | |
"name": ".raw", | |
"offset": "0x0", | |
"length": "0x34" | |
} | |
], | |
"memory": [ | |
{ | |
"offset": "0", | |
"raw": "55", | |
"type": "instruction", | |
"instruction": { | |
"operator": "push", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "ebp", | |
"regsize": "0x20", | |
"regnum": "0x05" | |
} | |
] | |
}, | |
"refs": [ | |
"0x01" | |
], | |
"xrefs": [ | |
], | |
"stack": "-0x04" | |
}, | |
{ | |
"offset": "0x01", | |
"raw": "89 e5", | |
"type": "instruction", | |
"instruction": { | |
"operator": "mov", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "ebp", | |
"regsize": "0x20", | |
"regnum": "0x05" | |
}, | |
{ | |
"type": "register", | |
"value": "esp", | |
"regsize": "0x20", | |
"regnum": "0x04" | |
} | |
] | |
}, | |
"refs": [ | |
"0x03" | |
], | |
"xrefs": [ | |
"0" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x03", | |
"raw": "8b 45 04", | |
"type": "instruction", | |
"instruction": { | |
"operator": "mov", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
}, | |
{ | |
"type": "memory", | |
"value": "dword ptr [ebp+4]", | |
"segment": null, | |
"memsize": "0x20", | |
"base_register": "", | |
"multiplier": "0x01", | |
"offset": "ebp", | |
"immediate": "0x04" | |
} | |
] | |
}, | |
"refs": [ | |
"0x06" | |
], | |
"xrefs": [ | |
"0x01" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x06", | |
"raw": "85 c0", | |
"type": "instruction", | |
"instruction": { | |
"operator": "test", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
}, | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
} | |
] | |
}, | |
"refs": [ | |
"0x08" | |
], | |
"xrefs": [ | |
"0x03" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x08", | |
"raw": "75 0d", | |
"type": "instruction", | |
"instruction": { | |
"operator": "jnz", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x17" | |
} | |
] | |
}, | |
"refs": [ | |
"0x0a", | |
"0x17" | |
], | |
"xrefs": [ | |
"0x06" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x0a", | |
"raw": "6a 57", | |
"type": "instruction", | |
"instruction": { | |
"operator": "push", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x57" | |
} | |
] | |
}, | |
"refs": [ | |
"0x0c" | |
], | |
"xrefs": [ | |
"0x08" | |
], | |
"stack": "-0x04" | |
}, | |
{ | |
"offset": "0x0c", | |
"raw": "e8 23 00 00 00", | |
"type": "instruction", | |
"instruction": { | |
"operator": "call", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x34" | |
} | |
] | |
}, | |
"refs": [ | |
"0x11" | |
], | |
"xrefs": [ | |
"0x0a" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x11", | |
"raw": "31 c0", | |
"type": "instruction", | |
"instruction": { | |
"operator": "xor", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
}, | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
} | |
] | |
}, | |
"refs": [ | |
"0x13" | |
], | |
"xrefs": [ | |
"0x0c" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x13", | |
"raw": "5d", | |
"type": "instruction", | |
"instruction": { | |
"operator": "pop", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "ebp", | |
"regsize": "0x20", | |
"regnum": "0x05" | |
} | |
] | |
}, | |
"refs": [ | |
"0x14" | |
], | |
"xrefs": [ | |
"0x11" | |
], | |
"stack": "0x04" | |
}, | |
{ | |
"offset": "0x14", | |
"raw": "c2 08 00", | |
"type": "instruction", | |
"instruction": { | |
"operator": "ret", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x08" | |
} | |
] | |
}, | |
"refs": [ | |
], | |
"xrefs": [ | |
"0x13" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x17", | |
"raw": "8a 08", | |
"type": "instruction", | |
"instruction": { | |
"operator": "mov", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
}, | |
{ | |
"type": "memory", | |
"value": "byte ptr [eax]", | |
"segment": null, | |
"memsize": "0x08", | |
"base_register": "", | |
"multiplier": "0x01", | |
"offset": "eax", | |
"immediate": "0" | |
} | |
] | |
}, | |
"refs": [ | |
"0x19" | |
], | |
"xrefs": [ | |
"0x08" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x19", | |
"raw": "84 c9", | |
"type": "instruction", | |
"instruction": { | |
"operator": "test", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
}, | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
} | |
] | |
}, | |
"refs": [ | |
"0x1b" | |
], | |
"xrefs": [ | |
"0x17" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x1b", | |
"raw": "74 11", | |
"type": "instruction", | |
"instruction": { | |
"operator": "jz", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x2e" | |
} | |
] | |
}, | |
"refs": [ | |
"0x1d", | |
"0x2e" | |
], | |
"xrefs": [ | |
"0x19" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x1d", | |
"raw": "8a 55 08", | |
"type": "instruction", | |
"instruction": { | |
"operator": "mov", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "dl", | |
"regsize": "0x08", | |
"regnum": "0x02" | |
}, | |
{ | |
"type": "memory", | |
"value": "byte ptr [ebp+8]", | |
"segment": null, | |
"memsize": "0x08", | |
"base_register": "", | |
"multiplier": "0x01", | |
"offset": "ebp", | |
"immediate": "0x08" | |
} | |
] | |
}, | |
"refs": [ | |
"0x20" | |
], | |
"xrefs": [ | |
"0x1b" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x20", | |
"raw": "eb 00", | |
"type": "instruction", | |
"instruction": { | |
"operator": "jmp", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x22" | |
} | |
] | |
}, | |
"refs": [ | |
"0x22" | |
], | |
"xrefs": [ | |
"0x1d" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x22", | |
"raw": "38 d1", | |
"type": "instruction", | |
"instruction": { | |
"operator": "cmp", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
}, | |
{ | |
"type": "register", | |
"value": "dl", | |
"regsize": "0x08", | |
"regnum": "0x02" | |
} | |
] | |
}, | |
"refs": [ | |
"0x24" | |
], | |
"xrefs": [ | |
"0x20", | |
"0x2c" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x24", | |
"raw": "74 0a", | |
"type": "instruction", | |
"instruction": { | |
"operator": "jz", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x30" | |
} | |
] | |
}, | |
"refs": [ | |
"0x26", | |
"0x30" | |
], | |
"xrefs": [ | |
"0x22" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x26", | |
"raw": "8a 48 01", | |
"type": "instruction", | |
"instruction": { | |
"operator": "mov", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
}, | |
{ | |
"type": "memory", | |
"value": "byte ptr [eax+1]", | |
"segment": null, | |
"memsize": "0x08", | |
"base_register": "", | |
"multiplier": "0x01", | |
"offset": "eax", | |
"immediate": "0x01" | |
} | |
] | |
}, | |
"refs": [ | |
"0x29" | |
], | |
"xrefs": [ | |
"0x24" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x29", | |
"raw": "40", | |
"type": "instruction", | |
"instruction": { | |
"operator": "inc", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
} | |
] | |
}, | |
"refs": [ | |
"0x2a" | |
], | |
"xrefs": [ | |
"0x26" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x2a", | |
"raw": "84 c9", | |
"type": "instruction", | |
"instruction": { | |
"operator": "test", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
}, | |
{ | |
"type": "register", | |
"value": "cl", | |
"regsize": "0x08", | |
"regnum": "0x01" | |
} | |
] | |
}, | |
"refs": [ | |
"0x2c" | |
], | |
"xrefs": [ | |
"0x29" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x2c", | |
"raw": "75 f4", | |
"type": "instruction", | |
"instruction": { | |
"operator": "jnz", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x22" | |
} | |
] | |
}, | |
"refs": [ | |
"0x2e", | |
"0x22" | |
], | |
"xrefs": [ | |
"0x2a" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x2e", | |
"raw": "31 c0", | |
"type": "instruction", | |
"instruction": { | |
"operator": "xor", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
}, | |
{ | |
"type": "register", | |
"value": "eax", | |
"regsize": "0x20", | |
"regnum": "0" | |
} | |
] | |
}, | |
"refs": [ | |
"0x30" | |
], | |
"xrefs": [ | |
"0x1b", | |
"0x2c" | |
], | |
"stack": "0" | |
}, | |
{ | |
"offset": "0x30", | |
"raw": "5d", | |
"type": "instruction", | |
"instruction": { | |
"operator": "pop", | |
"operands": [ | |
{ | |
"type": "register", | |
"value": "ebp", | |
"regsize": "0x20", | |
"regnum": "0x05" | |
} | |
] | |
}, | |
"refs": [ | |
"0x31" | |
], | |
"xrefs": [ | |
"0x24", | |
"0x2e" | |
], | |
"stack": "0x04" | |
}, | |
{ | |
"offset": "0x31", | |
"raw": "c2 08 00", | |
"type": "instruction", | |
"instruction": { | |
"operator": "ret", | |
"operands": [ | |
{ | |
"type": "immediate", | |
"value": "0x08" | |
} | |
] | |
}, | |
"refs": [ | |
], | |
"xrefs": [ | |
"0x30" | |
], | |
"stack": "0" | |
} | |
], | |
"status": "0" | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment