What does new operator return in assembly?

user_4881854 0
Viewed 3041

Here is my code in assembly:

.text:00401000                 push    ebp
.text:00401001                 mov     ebp, esp
.text:00401003                 sub     esp, 8
.text:00401006                 push    4               ; unsigned int
.text:00401008                 call    ??2@YAPAXI@Z    ; operator new(uint)
.text:0040100D                 add     esp, 4
.text:00401010                 mov     [ebp+var_8], eax
.text:00401013                 mov     eax, [ebp+var_8]
.text:00401016                 mov     [ebp+var_4], eax
.text:00401019                 mov     ecx, [ebp+var_4]
.text:0040101C                 mov     dword ptr [ecx], offset aHttpWww_practi ; "http://www.practicalmalwareanalysis.com"...
.text:00401022                 mov     ecx, [ebp+var_4]
.text:00401025                 call    sub_401040
.text:0040102A                 xor     eax, eax
.text:0040102C                 mov     esp, ebp
.text:0040102E                 pop     ebp
.text:0040102F                 retn    10h
.text:0040102F _WinMain@16     endp

But I'm little confused here. After

call ??2@YAPAXI@Z ; operator new(uint)

EAX register is set to some address which as I guess is address of a newly created object, I jump into that location and it contains nothing.

But

mov [ebp+var_8], eax

what should this instruction do? Should it put address of object into var_8 or the content(first 4 bytes) of object(which is nothing) into var_8? Well I checked and this is what I got.

I can't understand why this value is stored in var_8.

As I understand the code, It creates an object and puts the

http://www.practicalmalwareanalysis.com

string in it. But after this instruction below

mov dword ptr [ecx], offset aHttpWww_practi ; "http://www.practicalmalwareanalysis.com"...

I checked the address of object and this is what I have. It seemed to me that this is the address where string should be, so I jumped at 305040 and there was nothing. Then I jumped on 405030 and thats where I found the string. Why is the address "reversed"(if this is the right word to describe)?

P.S Sorry if my questions sound silly, I'm new with assembly. Thanks.

assembly visual-studio c++
1 Answers
call    ??2@YAPAXI@Z    ; operator new(uint)

eax is the address of the new object, it doesn't yet contain anything until the string is copied into it. Thus it's just pointing to a bunch of 0's.

mov     [ebp+var_8], eax

This stores the address in eax to the stack at [ebp+var_8] (var_8 is some consistent offset/constant in the subroutine acting as a local variable).

mov     dword ptr [ecx], offset aHttpWww_practi ;

Moves the offset (heap address) of the string into the block of memory pointed to by the address contained in ecx.

call    sub_401040

This actually copies the data from the offset now stored at the address ecx is pointing to, into the new object created in the first part. Presumably anyway, unless that happens after the ret.

user_59427970
Related