23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

}<br />

x40 = a3 | x31;<br />

x41 = x24 & ~x37;<br />

x42 = x41 | x3;<br />

x43 = x42 & ~a2;<br />

x44 = x40 ^ x43;<br />

x45 = a1 & ~x44;<br />

x46 = x39 ^ ~x45;<br />

*out1 ^= x46;<br />

x47 = x33 & ~x9;<br />

x48 = x47 ^ x39;<br />

x49 = x4 ^ x36;<br />

x50 = x49 & ~x5;<br />

x51 = x42 | x18;<br />

x52 = x51 ^ a5;<br />

x53 = a2 & ~x52;<br />

x54 = x50 ^ x53;<br />

x55 = a1 | x54;<br />

x56 = x48 ^ ~x55;<br />

*out3 ^= x56;<br />

There is a lot of local variables. Of course, not them all will be in local stack. Let’s compile it with<br />

MSVC 2008 with /Ox option:<br />

PUBLIC _s1<br />

; Function compile flags: /Ogtpy<br />

_TEXT SEGMENT<br />

_x6$ = -20 ; size = 4<br />

_x3$ = -16 ; size = 4<br />

_x1$ = -12 ; size = 4<br />

_x8$ = -8 ; size = 4<br />

_x4$ = -4 ; size = 4<br />

_a1$ = 8 ; size = 4<br />

_a2$ = 12 ; size = 4<br />

_a3$ = 16 ; size = 4<br />

_x33$ = 20 ; size = 4<br />

_x7$ = 20 ; size = 4<br />

_a4$ = 20 ; size = 4<br />

_a5$ = 24 ; size = 4<br />

tv326 = 28 ; size = 4<br />

_x36$ = 28 ; size = 4<br />

_x28$ = 28 ; size = 4<br />

_a6$ = 28 ; size = 4<br />

_out1$ = 32 ; size = 4<br />

_x24$ = 36 ; size = 4<br />

_out2$ = 36 ; size = 4<br />

_out3$ = 40 ; size = 4<br />

_out4$ = 44 ; size = 4<br />

_s1 PROC<br />

sub esp, 20 ; 00000014H<br />

mov edx, DWORD PTR _a5$[esp+16]<br />

push ebx<br />

mov ebx, DWORD PTR _a4$[esp+20]<br />

push ebp<br />

push esi<br />

105

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!