23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

(_snprintf() function works just like printf(), but instead dumping result in<strong>to</strong> stdout (e.g., <strong>to</strong> terminal<br />

or console), write it <strong>to</strong> buf buffer. puts() copies buf contents <strong>to</strong> stdout. Of course, these two function calls<br />

might be replaced by one printf() call, but I would like <strong>to</strong> illustrate small buffer usage.)<br />

Let’s compile (MSVC 2010):<br />

...<br />

...<br />

mov eax, 600 ; 00000258H<br />

call __alloca_probe_16<br />

mov esi, esp<br />

push 3<br />

push 2<br />

push 1<br />

push OFFSET $SG2672<br />

push 600 ; 00000258H<br />

push esi<br />

call __snprintf<br />

push esi<br />

call _puts<br />

add esp, 28 ; 0000001cH<br />

The sole alloca() argument passed via EAX (instead of pushing in<strong>to</strong> stack).<br />

After alloca() call, ESP is now pointing <strong>to</strong> the block of 600 bytes and we can use it as memory <strong>for</strong> buf<br />

array.<br />

GCC 4.4.1 can do the same without calling external functions:<br />

public f<br />

f proc near ; CODE XREF: main+6<br />

s = dword ptr -10h<br />

var_C = dword ptr -0Ch<br />

push ebp<br />

mov ebp, esp<br />

sub esp, 38h<br />

mov eax, large gs:14h<br />

mov [ebp+var_C], eax<br />

xor eax, eax<br />

sub esp, 624<br />

lea eax, [esp+18h]<br />

add eax, 0Fh<br />

shr eax, 4 ; align pointer<br />

shl eax, 4 ; by 16-byte border<br />

mov [ebp+s], eax<br />

mov eax, offset <strong>for</strong>mat ; "hi! %d, %d, %d\n"<br />

mov dword ptr [esp+14h], 3<br />

mov dword ptr [esp+10h], 2<br />

mov dword ptr [esp+0Ch], 1<br />

mov [esp+8], eax ; <strong>for</strong>mat<br />

mov dword ptr [esp+4], 600 ; maxlen<br />

mov eax, [ebp+s]<br />

6

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!