Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
push ecx<br />
mov DWORD PTR _this$[ebp], ecx<br />
mov eax, DWORD PTR _this$[ebp]<br />
mov ecx, DWORD PTR _a$[ebp]<br />
mov DWORD PTR [eax], ecx<br />
mov edx, DWORD PTR _this$[ebp]<br />
mov eax, DWORD PTR _b$[ebp]<br />
mov DWORD PTR [edx+4], eax<br />
mov eax, DWORD PTR _this$[ebp]<br />
mov esp, ebp<br />
pop ebp<br />
ret 8<br />
??0c@@QAE@HH@Z ENDP ; c::c<br />
Construc<strong>to</strong>rs are just functions, they use pointer <strong>to</strong> structure in ECX, moving the pointer in<strong>to</strong> own local<br />
variable, however, it’s not necessary.<br />
Now dump() method:<br />
_this$ = -4 ; size = 4<br />
?dump@c@@QAEXXZ PROC ; c::dump, COMDAT<br />
; _this$ = ecx<br />
push ebp<br />
mov ebp, esp<br />
push ecx<br />
mov DWORD PTR _this$[ebp], ecx<br />
mov eax, DWORD PTR _this$[ebp]<br />
mov ecx, DWORD PTR [eax+4]<br />
push ecx<br />
mov edx, DWORD PTR _this$[ebp]<br />
mov eax, DWORD PTR [edx]<br />
push eax<br />
push OFFSET ??_C@_07NJBDCIEC@?$CFd?$DL?5?$CFd?6?$AA@<br />
call _printf<br />
add esp, 12 ; 0000000cH<br />
mov esp, ebp<br />
pop ebp<br />
ret 0<br />
?dump@c@@QAEXXZ ENDP ; c::dump<br />
Simple enough: dump() taking pointer <strong>to</strong> the structure containing two int’s in ECX, takes two values from<br />
it and passing it in<strong>to</strong> printf().<br />
The code is much shorter if compiled with optimization (/Ox):<br />
??0c@@QAE@XZ PROC ; c::c, COMDAT<br />
; _this$ = ecx<br />
mov eax, ecx<br />
mov DWORD PTR [eax], 667 ; 0000029bH<br />
mov DWORD PTR [eax+4], 999 ; 000003e7H<br />
ret 0<br />
??0c@@QAE@XZ ENDP ; c::c<br />
_a$ = 8 ; size = 4<br />
_b$ = 12 ; size = 4<br />
??0c@@QAE@HH@Z PROC ; c::c, COMDAT<br />
; _this$ = ecx<br />
mov edx, DWORD PTR _b$[esp-4]<br />
81