Learn lf2.exe from C

[o_g349]

Learn lf2.exe from C

This tutorial teach you how to use C to understand what the assembly means in lf2.exe.
Please download the tool IDA and ollydbg, we use these tools to find what lf2.exe doing in this tutorial.

Stack frame

Lets checkout this function func_417400.
At begining

When this function get called, the stack will pushed a return address.
The return address is where to jump back when this function is doned and ready to return.


When the sub esp,30 is executed, stack pointer (esp) will prepare the space for local variables usage.


When the mov eax,dword ptr ss:[esp+34] is executed, we get the first argument of this function and store it in eax register.

So the definition of this function looks like:

C-Code: int func_417400(arg_1) { }

When the push esi is executed, we save the data in esi register to prevent the code below from ruining the data in esi register.
We will use esi register for another purpose in code below.


When the mov esi,ecx is executed, we copy the this pointer to esi register.
Because LF2 is developed by Visual C++, by convension, Visual C++ compiler uses ecx register to transfor the this pointer to the function be called.
You can regard this pointer as a first argument of this function in C.
So the definition of this function looks like:

C-Code: int func_417400(this, arg_1) { }

Code in function

Now we look this code:


The first line mov eax,dword ptr ds:[esi+eax*4+194] is a little bit complicated, this instruction use two registers to locate the address which data is stored in.
We can translate this intruction to mov eax,dword ptr ds:[this+arg_1*4+194].

By using this image, we know arg_1 should be index of objects and this pointer should be struct 'global' pointer, so the definition of this function becomes:

C-Code: int func_417400(struct global * global, uint32_t object_index) { }

By inspecting this intruction mov eax,dword ptr ds:[this+arg_1*4+194], we know corresponding C code:

C-Code: struct object * a_object = global->objects[object_index];

By using the data structure, we can understand what the code below means.

The second line mov ecx,dword ptr ds:[eax+7C] means:

C-Code: uint32_t frame_id = a_object->frame_id;

The third line mov edx,dword ptr ds:[eax+368] means:

C-Code: struct file * a_file = a_object->file;

These two lines imul ecx,ecx,178 and lea ecx,dword ptr ds:[ecx+edx+7A4] means:

C-Code: struct frame * a_frame = &a_file->frames[frame_id];

So the function should looks like:

C-Code: int func_417400(struct global * global, uint32_t object_index) { struct object * a_object = global->objects[object_index]; uint32_t frame_id = a_object->frame_id; struct file * a_file = a_object->file; struct frame * a_frame = &a_file->frames[frame_id]; }

If you have any question, please reply below.
Thanks you for reading this tutorial :)

[A-Man]

AMAZING! I really learned a lot from that. Few questions though:

When the sub esp,30 is executed, stack pointer (esp) will prepare the space for local variables usage.

So is that actually the process of allocation of data (variables and objects)? We just subtract the stack pointer?

These two lines imul ecx,ecx,178 and lea ecx,dword ptr ds:[ecx+edx+7A4] means:
C Programming

C-Code: struct frame * a_frame = &a_file->frames[frame_id];

I don't understand how that would possibly be all this. The 178 is probably the size of some object being multiplied by the index to find its address. The second line though, doesn't make any sense to me. Check this out:
http://www.lf-empire.de/forum/showthread.php?tid=9316
There ^; lea together with dword ptr ds seems to actually store the sum value of ecx + edx + 7A4 into ecx; not fetch data of that address (right?). In this case though, it worked differently again 0_o. Can you get into more details with that please?

Thanks a lot!!!

[o_g349]

So is that actually the process of allocation of data (variables and objects)? We just subtract the stack pointer?

Yes, we subtract the stack pointer.
Another reason is that we don't know if this function calls another function, so we subtract the stack pointer to prevent the local variables from ruining by the function called in this function.

There ^; lea together with dword ptr ds seems to actually store the sum value of ecx + edx + 7A4 into ecx; not fetch data of that address (right?)

Right, so imul ecx,ecx,178 and lea ecx,dword ptr ds:[ecx+edx+7A4] means lea address_of_frame,dword ptr ds:[frame_id * 178 + file + 7A4]

[A-Man]

I appreciate all the detailed explanation :3. So I got it right at the beginning, but it feels weird to see addresses calculated like that so I mixed stuff there. Thanks a lot!

[o_g349]

No problem

[MH-LABEEB]

Can I get the download link please.

[A-Man]

There is no download link. This is a tutorial.

[MH-LABEEB]

So,What's this about I can't understood. Can you tell me?

[Memento]

So,What's this about I can't  understood. Can you tell me?

Does this mean you are going to make your own .exe?

Please read the first post of this topic and use google.

In more detail:

Spoiler (Click to View)

This tutorial teach you how to use C to understand what the assembly means in lf2.exe.

I even underlined for you what you should look for on google. Even if you set the language to the one you speak, you should also be able to find something probably.

If you don't understand what this is all about, look for a basic step-by-step tutorial on how to work on the LF2 .exe. I'm pretty sure there is something like that on this forum. It's best to start off as basic as possible.

[A-Man]

There is assembly (a programming language), and there is C (a higher-level programming language). Assembly is what you see when you open LF2 in OllyDBG. This tutorial teaches you how to interpret assembly codes as C codes. If you don't know how to program in C, then this tutorial will not make sense to you.