Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
EBX is a pointer <strong>to</strong> internal array:<br />
.text:0054107D lea ebx, [esp+50h+internal_array_64]<br />
.text:00541081<br />
Two nested loops are here:<br />
.text:00541081 first_loop1_begin:<br />
.text:00541081 xor esi, esi ; ESI is loop 2 counter<br />
.text:00541083<br />
.text:00541083 first_loop2_begin:<br />
.text:00541083 push ebp ; arg_0<br />
.text:00541084 push esi ; loop 1 counter<br />
.text:00541085 push edi ; loop 2 counter<br />
.text:00541086 call get_bit<br />
.text:0054108B add esp, 0Ch<br />
.text:0054108E mov [ebx+esi], al ; s<strong>to</strong>re <strong>to</strong> internal array<br />
.text:00541091 inc esi ; increment loop 1 counter<br />
.text:00541092 cmp esi, 8<br />
.text:00541095 jl short first_loop2_begin<br />
.text:00541097 inc edi ; increment loop 2 counter<br />
.text:00541098 add ebx, 8 ; increment internal array pointer by 8 at each<br />
loop 1 iteration<br />
.text:0054109B cmp edi, 8<br />
.text:0054109E jl short first_loop1_begin<br />
... we see that both loop counters are in range 0..7. Also, they are used as first and second arguments of<br />
get_bit(). Third argument of get_bit() is the only argument of rotate1(). What get_bit() returns, is<br />
being placed in<strong>to</strong> internal array.<br />
Prepare pointer <strong>to</strong> internal array again:<br />
.text:005410A0 lea ebx, [esp+50h+internal_array_64]<br />
.text:005410A4 mov edi, 7 ; EDI is loop 1 counter, initial state is 7<br />
.text:005410A9<br />
.text:005410A9 second_loop1_begin:<br />
.text:005410A9 xor esi, esi ; ESI is loop 2 counter<br />
.text:005410AB<br />
.text:005410AB second_loop2_begin:<br />
.text:005410AB mov al, [ebx+esi] ; value from internal array<br />
.text:005410AE push eax<br />
.text:005410AF push ebp ; arg_0<br />
.text:005410B0 push edi ; loop 1 counter<br />
.text:005410B1 push esi ; loop 2 counter<br />
.text:005410B2 call set_bit<br />
.text:005410B7 add esp, 10h<br />
.text:005410BA inc esi ; increment loop 2 counter<br />
.text:005410BB cmp esi, 8<br />
.text:005410BE jl short second_loop2_begin<br />
.text:005410C0 dec edi ; decrement loop 2 counter<br />
.text:005410C1 add ebx, 8 ; increment pointer in internal array<br />
.text:005410C4 cmp edi, 0FFFFFFFFh<br />
.text:005410C7 jg short second_loop1_begin<br />
.text:005410C9 pop edi<br />
.text:005410CA pop esi<br />
.text:005410CB pop ebp<br />
.text:005410CC pop ebx<br />
174