23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

4.1.3 Task 1.3<br />

This is standard C function <strong>to</strong>o, actually, two functions working in pair. Source code taken from MSVC<br />

2010 and modified sligthly.<br />

The matter of modification is that this function can work properly in multi-threaded environment, and<br />

I removed its support <strong>for</strong> simplification (or <strong>for</strong> confusion).<br />

Compiled in MSVC 2010 with /Ox flag.<br />

_BSS SEGMENT<br />

_v DD 01H DUP (?)<br />

_BSS ENDS<br />

_TEXT SEGMENT<br />

_s$ = 8 ; size = 4<br />

f1 PROC<br />

push ebp<br />

mov ebp, esp<br />

mov eax, DWORD PTR _s$[ebp]<br />

mov DWORD PTR _v, eax<br />

pop ebp<br />

ret 0<br />

f1 ENDP<br />

_TEXT ENDS<br />

PUBLIC f2<br />

_TEXT SEGMENT<br />

f2 PROC<br />

push ebp<br />

mov ebp, esp<br />

mov eax, DWORD PTR _v<br />

imul eax, 214013 ; 000343fdH<br />

add eax, 2531011 ; 00269ec3H<br />

mov DWORD PTR _v, eax<br />

mov eax, DWORD PTR _v<br />

shr eax, 16 ; 00000010H<br />

and eax, 32767 ; 00007fffH<br />

pop ebp<br />

ret 0<br />

f2 ENDP<br />

_TEXT ENDS<br />

END<br />

Same code compiled in GCC 4.4.1:<br />

public f1<br />

f1 proc near<br />

arg_0 = dword ptr 8<br />

push ebp<br />

mov ebp, esp<br />

mov eax, [ebp+arg_0]<br />

mov ds:v, eax<br />

pop ebp<br />

retn<br />

f1 endp<br />

128

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!