Quick introduction to reverse engineering for beginners

7.2 SAP client network traffic compression case
(Tracing connection between TDW_NOCOMPRESS SAPGUI 3 environment variable to nagging pop-up
window and actual data compression routine.)
It’s known that network traffic between SAPGUI and SAP is not crypted by default, it’s rather compressed
(read here and here).
It’s also known that by setting environment variable TDW_NOCOMPRESS to 1, it’s possible to turn
network packets compression off.
But you will see a nagging pop-up windows that cannot be closed:
Figure 7.1: Screenshot
Let’s see, if we can remove that window somehow.
But before this, let’s see what we already know. First: we know that environment variable TDW_NOCOMPRESS
is checked somewhere inside of SAPGUI client. Second: string like “data compression switched off” must be
present somewhere too. With the help of FAR file manager I found that both of these strings are stored in
the SAPguilib.dll file.
So let’s open SAPguilib.dll in IDA 5 and search for “TDW_NOCOMPRESS” string. Yes, it is present
and there is only one reference to it.
We see the following piece of code (all file offsets are valid for SAPGUI 720 win32, SAPguilib.dll file
version 7200,1,0,9009):
.text:6440D51B lea eax, [ebp+2108h+var_211C]
.text:6440D51E push eax ; int
.text:6440D51F push offset aTdw_nocompress ; "TDW_NOCOMPRESS"
.text:6440D524 mov byte ptr [edi+15h], 0
.text:6440D528 call chk_env
.text:6440D52D pop ecx
.text:6440D52E pop ecx
.text:6440D52F push offset byte_64443AF8
.text:6440D534 lea ecx, [ebp+2108h+var_211C]
; demangled name: int ATL::CStringT::Compare(char const *)const
.text:6440D537 call ds:mfc90_1603
3 SAP GUI client
183