23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

xor ebp, ebx<br />

not eax<br />

mov DWORD PTR [edi], ebp<br />

xor eax, ecx<br />

mov ecx, DWORD PTR _out3$[esp+32]<br />

xor eax, DWORD PTR [ecx]<br />

pop edi<br />

pop esi<br />

xor eax, ebx<br />

pop ebp<br />

mov DWORD PTR [ecx], eax<br />

pop ebx<br />

add esp, 20 ; 00000014H<br />

ret 0<br />

_s1 ENDP<br />

5 variables was allocated in local stack by compiler.<br />

Now let’s try the same thing in 64-bit version of MSVC 2008:<br />

a1$ = 56<br />

a2$ = 64<br />

a3$ = 72<br />

a4$ = 80<br />

x36$1$ = 88<br />

a5$ = 88<br />

a6$ = 96<br />

out1$ = 104<br />

out2$ = 112<br />

out3$ = 120<br />

out4$ = 128<br />

s1 PROC<br />

$LN3:<br />

mov QWORD PTR [rsp+24], rbx<br />

mov QWORD PTR [rsp+32], rbp<br />

mov QWORD PTR [rsp+16], rdx<br />

mov QWORD PTR [rsp+8], rcx<br />

push rsi<br />

push rdi<br />

push r12<br />

push r13<br />

push r14<br />

push r15<br />

mov r15, QWORD PTR a5$[rsp]<br />

mov rcx, QWORD PTR a6$[rsp]<br />

mov rbp, r8<br />

mov r10, r9<br />

mov rax, r15<br />

mov rdx, rbp<br />

not rax<br />

xor rdx, r9<br />

not r10<br />

mov r11, rax<br />

and rax, r9<br />

mov rsi, r10<br />

mov QWORD PTR x36$1$[rsp], rax<br />

108

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!