23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

So, let’s download Linux Kernel 2.6.31, compile it in Ubuntu: make vmlinux, open it in IDA 5, find the<br />

do_filp_open() function. At the beginning, we will see (comments are mine):<br />

do_filp_open proc near<br />

...<br />

push ebp<br />

mov ebp, esp<br />

push edi<br />

push esi<br />

push ebx<br />

mov ebx, ecx<br />

add ebx, 1<br />

sub esp, 98h<br />

mov esi, [ebp+arg_4] ; acc_mode (5th arg)<br />

test bl, 3<br />

mov [ebp+var_80], eax ; dfd (1th arg)<br />

mov [ebp+var_7C], edx ; pathname (2th arg)<br />

mov [ebp+var_78], ecx ; open_flag (3th arg)<br />

jnz short loc_C01EF684<br />

mov ebx, ecx ; ebx

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!