Quick introduction to reverse engineering for beginners

GCC replaced first printf() call to puts(). Indeed: printf() with only sole argument is almost
analogous to puts().
Almost, because we need to be sure that this string will not contain printf-control statements starting
with % : then effect of these two functions will be different.
Why GCC replaced printf() to puts? Because puts() work faster 11 .
It working faster because just passes characters to stdout not comparing each with % symbol.
As before — arguments are placed into stack by MOV instruction.
1.4.1 Global variables
What if x variable from previous example will not be local but global variable? Then it will be accessible
from any place but not only from function body. It is not very good programming practice, but for the sake
of experiment we could do this.
_DATA SEGMENT
COMM _x:DWORD
$SG2456 DB ’Enter X:’, 0aH, 00H
ORG $+2
$SG2457 DB ’%d’, 00H
ORG $+1
$SG2458 DB ’You entered %d...’, 0aH, 00H
_DATA ENDS
PUBLIC _main
EXTRN _scanf:PROC
EXTRN _printf:PROC
; Function compile flags: /Odtp
_TEXT SEGMENT
_main PROC
push ebp
mov ebp, esp
push OFFSET $SG2456
call _printf
add esp, 4
push OFFSET _x
push OFFSET $SG2457
call _scanf
add esp, 8
mov eax, DWORD PTR _x
push eax
push OFFSET $SG2458
call _printf
add esp, 8
xor eax, eax
pop ebp
ret 0
_main ENDP
_TEXT ENDS
Now x variable is defined in _DATA segment. Memory in local stack is not allocated anymore. All accesses
to it are not via stack but directly to process memory. Its value is not defined. This mean that memory
will be allocated by operation system, but not compiler, neither operation system will not take care about
its initial value at the moment of main() function start. As experiment, try to declare large array and see
what will it contain after program loading.
Now let’s assign value to variable explicitly:
11 http://www.ciselant.de/projects/gcc_printf/gcc_printf.html
12