23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

t = dword ptr -0Ch<br />

i = dword ptr -8<br />

arg_0 = dword ptr 8<br />

push ebp<br />

mov ebp, esp<br />

push ebx<br />

sub esp, 10h<br />

mov [ebp+rt], 0<br />

mov [ebp+i], 0<br />

jmp short loc_80483EF<br />

loc_80483D0:<br />

mov eax, [ebp+i]<br />

mov edx, 1<br />

mov ebx, edx<br />

mov ecx, eax<br />

shl ebx, cl<br />

mov eax, ebx<br />

and eax, [ebp+arg_0]<br />

test eax, eax<br />

jz short loc_80483EB<br />

add [ebp+rt], 1<br />

loc_80483EB:<br />

add [ebp+i], 1<br />

loc_80483EF:<br />

cmp [ebp+i], 1Fh<br />

jle short loc_80483D0<br />

mov eax, [ebp+rt]<br />

add esp, 10h<br />

pop ebx<br />

pop<br />

retn<br />

ebp<br />

f endp<br />

Shift instructions are often used in division and multiplications by power of two numbers (1, 2, 4, 8, etc).<br />

For example:<br />

unsigned int f(unsigned int a)<br />

{<br />

return a/4;<br />

};<br />

We got (MSVC 2010):<br />

_a$ = 8 ; size = 4<br />

_f PROC<br />

mov eax, DWORD PTR _a$[esp-4]<br />

shr eax, 2<br />

ret 0<br />

_f ENDP<br />

SHR (SHift Right) instruction is shifting a number by 2 bits right. Two freed bits at left (e.g., two most<br />

significant bits) are set <strong>to</strong> zero. Two least significant bits are dropped. In fact, these two dropped bits —<br />

division operation remainder.<br />

It can be easily unders<strong>to</strong>od if <strong>to</strong> imagine decimal numeral system and number 23. 23 can be easily divided<br />

60

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!