Quick introduction to reverse engineering for beginners

jge SHORT $LN1@main
mov ecx, DWORD PTR _i$[ebp]
mov edx, DWORD PTR _i$[ebp] ; that insruction is obviously redundant
mov DWORD PTR _a$[ebp+ecx*4], edx ; ECX could be used as second operand here instead
jmp SHORT $LN2@main
$LN1@main:
xor eax, eax
mov esp, ebp
pop ebp
ret 0
_main ENDP
Run compiled program and its crashing. No wonder. Let’s see, where exactly it’s crashing.
I’m not using debugger anymore, because I tired to run it each time, move mouse, etc, when I need just to
spot some register’s state at specific point. That’s why I wrote very minimalistic tool for myself, tracer 5.0.1,
which is enough for my tasks.
I can also use it just to see, where debuggee is crashed. So let’s see:
generic tracer 0.4 (WIN32), http://conus.info/gt
New process: C:\PRJ\...\1.exe, PID=7988
EXCEPTION_ACCESS_VIOLATION: 0x15 (),
ExceptionInformation[0]=8
EAX=0x00000000 EBX=0x7EFDE000 ECX=0x0000001D EDX=0x0000001D
ESI=0x00000000 EDI=0x00000000 EBP=0x00000014 ESP=0x0018FF48
EIP=0x00000015
FLAGS=PF ZF IF RF
PID=7988|Process exit, return code -1073740791
So, please keep an eye on registers.
Exception occured at address 0x15. It’s not legal address for code — at least for win32 code! We trapped
there somehow against our will. It’s also interesting fact that EBP register contain 0x14, ECX and EDX — 0x1D.
Let’s study stack layout more.
After control flow was passed into main(), EBP register value was saved into stack. Then, 84 bytes was
allocated for array and i variable. That’s (20+1)*sizeof(int). ESP pointing now to _i variable in local
stack and after execution of next PUSH something, something will be appeared next to _i.
That’s stack layout while control is inside _main:
ESP 4 bytes for i
ESP+4 80 bytes for a[20] array
ESP+84 saved EBP value
ESP+88 returning address
Instruction a[19]=something writes last int in array bounds (in bounds yet!)
Instruction a[20]=something writes something to the place where EBP value is saved.
Please take a look at registers state at the crash moment. In our case, number 20 was written to 20th
element. By the function ending, function epilogue restore EBP value. (20 in decimal system is 0x14 in
hexadecimal). Then, RET instruction was executed, which is equivalent to POP EIP instruction.
RET instruction taking returning adddress from stack (that’s address in some CRT 40 -function, which was
called _main), and 21 was stored there (0x15 in hexadecimal). The CPU trapped at the address 0x15, but
there are no executable code, so exception was raised.
Welcome! It’s called buffer overflow 41 .
40 C Run-Time
41 http://en.wikipedia.org/wiki/Stack_buffer_overflow
50