23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

_key$ = 8 ; size = 4<br />

_len$ = 12 ; size = 4<br />

_hash$ = 16 ; size = 4<br />

_crc PROC<br />

mov edx, DWORD PTR _len$[esp-4]<br />

xor ecx, ecx ; i will be s<strong>to</strong>red in ECX<br />

mov eax, edx<br />

test edx, edx<br />

jbe SHORT $LN1@crc<br />

push ebx<br />

push esi<br />

mov esi, DWORD PTR _key$[esp+4] ; ESI = key<br />

push edi<br />

$LL3@crc:<br />

; work with bytes using only 32-bit registers. byte from address key+i we s<strong>to</strong>re in<strong>to</strong> EDI<br />

movzx edi, BYTE PTR [ecx+esi]<br />

mov ebx, eax ; EBX = (hash = len)<br />

and ebx, 255 ; EBX = hash & 0xff<br />

; XOR EDI, EBX (EDI=EDI^EBX) - this operation uses all 32 bits of each register<br />

; but other bits (8-31) are cleared all time, so it’s OK<br />

; these are cleared because, as <strong>for</strong> EDI, it was done by MOVZX instruction above<br />

; high bits of EBX was cleared by AND EBX, 255 instruction above (255 = 0xff)<br />

xor edi, ebx<br />

; EAX=EAX>>8; bits 24-31 taken "from nowhere" will be cleared<br />

shr eax, 8<br />

; EAX=EAX^crctab[EDI*4] - choose EDI-th element from crctab[] table<br />

xor eax, DWORD PTR _crctab[edi*4]<br />

inc ecx ; i++<br />

cmp ecx, edx ; i

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!