Problem - Kevin Tafuro

function at the top of the stack. The saved frame pointer is moved into the ebp register,
and the return address is moved into the ecx register so that these values can be
preserved across the return. The instruction movl0f, %edx stores the address of the
local code label 0: in the edx register. This address is then pushed onto the stack,
where it becomes the new return address. The following ret instruction causes the
program to jump to code label 0:, where the execution context of the function (the
stack and frame pointers, saved frame pointer, and return address) is restored to its
original state.
When a disassembler follows the control flow of the program, rather than blindly
disassembling instructions from the start of the code segment, it will encounter the
false return statement and will stop disassembly of the current function. As a result,
any instructions after the false return will not be disassembled, and they will appear
as data located in the code segment.
void my_func(void) {
int x;
for (x = 0; x < 10; x++) printf("%x\n", x);
DISASM_FALSERET;
/* other stuff can be done here that won't be disassembled */
}
This produces the following disassembly in IDA Pro:
08048357 51 push ecx
08048358 53 push ebx
08048359 52 push edx
0804835A 89 E3 mov ebx, esp
0804835C 89 EC mov esp, ebp
0804835E 5D pop ebp
0804835F 59 pop ecx
08048360 8D 15 69 83 04 08 lea edx, ds:dword_8048369
08048366 52 push edx
08048367 C3 retn
08048367 my_func endp ; sp = -0Ch
08048367
08048367 ;----------------------------------------------------------------
08048368 0F db 0Fh ;
08048369 51 55 89 E5 dword_8048369 dd 0E5895551h
08048369 ; DATA XREF: my_func+38#r
0804836D 89 db 89h ; ë
0804836E DC db 0DCh ; ?
0804836F 5A db 5Ah ; Z
08048370 5B db 5Bh ; [
08048371 59 db 59h ; Y
08048372 C9 db 0C9h ; +
08048373 C3 db 0C3h ; +
The false return at address 08048367 ends the function, with the subsequent code
not being disassembled. The XREF at address 08048369, however, clearly indicates
that something strange is going on, even though the disassembly is incorrect. There
is also an indication of a stack error at the endp directive. A cracker can simply exam-
692 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.