23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Let’s compile it in MSVC 2010 (I omitted some parts <strong>for</strong> the sake of brefity) with /Ox option:<br />

__a$ = 8 ; size = 4<br />

__b$ = 12 ; size = 4<br />

_comp PROC<br />

mov eax, DWORD PTR __a$[esp-4]<br />

mov ecx, DWORD PTR __b$[esp-4]<br />

mov eax, DWORD PTR [eax]<br />

mov ecx, DWORD PTR [ecx]<br />

cmp eax, ecx<br />

jne SHORT $LN4@comp<br />

xor eax, eax<br />

ret 0<br />

$LN4@comp:<br />

xor edx, edx<br />

cmp eax, ecx<br />

setge dl<br />

lea eax, DWORD PTR [edx+edx-1]<br />

ret 0<br />

_comp ENDP<br />

...<br />

_numbers$ = -44 ; size = 40<br />

_i$ = -4 ; size = 4<br />

_argc$ = 8 ; size = 4<br />

_argv$ = 12 ; size = 4<br />

_main PROC<br />

push ebp<br />

mov ebp, esp<br />

sub esp, 44 ; 0000002cH<br />

mov DWORD PTR _numbers$[ebp], 1892 ; 00000764H<br />

mov DWORD PTR _numbers$[ebp+4], 45 ; 0000002dH<br />

mov DWORD PTR _numbers$[ebp+8], 200 ; 000000c8H<br />

mov DWORD PTR _numbers$[ebp+12], -98 ; ffffff9eH<br />

mov DWORD PTR _numbers$[ebp+16], 4087 ; 00000ff7H<br />

mov DWORD PTR _numbers$[ebp+20], 5<br />

mov DWORD PTR _numbers$[ebp+24], -12345 ; ffffcfc7H<br />

mov DWORD PTR _numbers$[ebp+28], 1087 ; 0000043fH<br />

mov DWORD PTR _numbers$[ebp+32], 88 ; 00000058H<br />

mov DWORD PTR _numbers$[ebp+36], -100000 ; fffe7960H<br />

push OFFSET _comp<br />

push 4<br />

push 10 ; 0000000aH<br />

lea eax, DWORD PTR _numbers$[ebp]<br />

push eax<br />

call _qsort<br />

add esp, 16 ; 00000010H<br />

...<br />

Nothing surprising so far. As a fourth argument, an address of label _comp is passed, that’s just a place<br />

where function comp() located.<br />

How qsort() calling it?<br />

Let’s take a look in<strong>to</strong> this function located in MSVCR80.DLL (a MSVC DLL module with C standard<br />

89

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!