Problem - Kevin Tafuro

" movl 0f( , %%ebx ), %%eax \n\t" \
" jmp *%%eax \n" \
"0: \n\t" \
" .long 1f\n\t" \
" .long 2f\n" \
"1: \n" \
: : "a" (val) : "%ebx");
#define ELSE \
asm(" jmp 3f\n\t" \
"2: \n");
#define ENDIF \
asm("3: \n");
The IF_ZERO macro places the value to be tested in the eax register, then uses the negl
instruction to set the carry flag if the value in the eax register is nonzero. The carry
flag is then rotated into a register and used as an index into a jump table. The macro
can be used to test for equality by subtracting one value from another and passing it
the result. The following example demonstrates how to use IF_ZERO to test the result
of calloc( ). Note that the ELSE macro must be included even if an else condition is
not needed.
struct MY_STRUCT my_struct;
my_struct = calloc(sizeof(struct MY_STRUCT), 1);
IF_ZERO(my_struct)
fprintf(stderr, "alloc failed\n");
return 0;
ELSE /* the else is required */
ENDIF
The C if statement itself is simple, and it is easy to recognize in a binary. For example:
int value = check_input(user_input);
if (value) {
; /* success-handling code here */
}
This will usually be compiled as a test of value followed by a jnz instruction. Comparing
value with a constant results in a jnz instruction following a compare of value
with that constant. Changing the type of the value being tested from an integer to a
floating-point number will change not only its representation in memory, but also
the actual assembly-language comparison instruction:
float value = check_input(user_input);
if (value = = 1.0) {
; /* success-handling code here */
}
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Obfuscating Code | 661