Reverse Engineering: C++ for operator

Post on 04-Jul-2015

3.429 views 4 download

description

Reverse engineering tip for C++ FOR operator

Transcript of Reverse Engineering: C++ for operator

C++ foroperator

How does C++ for operator truly look like

He doesn’t know this

She doesn’t know this either

... he doesn’t even care

He definitely does!

do you

MicrosoftVisual C++

x86 Assembler

&

let’s take

and have a look …

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

void _tmain(int argc, _TCHAR* argv[]){

for (int i = 0; i < 255; ++i){

printf(“%x", i);}

}

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

void _tmain(int argc, _TCHAR* argv[]){

for (int i = 0; i < 255; ++i){

printf(“%x", i);}

}

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

void _tmain(int argc, _TCHAR* argv[]){

for (int i = 0; i < 255; ++i){

printf(“%x", i);}

}

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

void _tmain(int argc, _TCHAR* argv[]){

for (int i = 0; i < 255; ++i){

printf(“%x", i);}

}

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

void _tmain(int argc, _TCHAR* argv[]){

for (int i = 0; i < 255; ++i){

printf(“%x", i);}

}

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

void _tmain(int argc, _TCHAR* argv[]){

for (int i = 0; i < 255; ++i){

printf(“%x", i);}

}

How it could have beenrecognized in assembly

Quite simple. Just ...

Counter changing

by the presence of the instructions of…

Counter comparison

Jumps

Counter changing

Counter comparison

Jumps

by the presence of the instructions of…

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

Counter changing

Counter comparison

Jumps

by the presence of the instructions of…

Counter changing

Counter comparison

Jumps

by the presence of the instructions of…

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

Counter changing

Counter comparison

Jumps

by the presence of the instructions of…

Counter changing

Counter comparison

Jumps

by the presence of the instructions of…

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

_main proc nearpush esixor esi, esi

loc_401003:push esipush offset “%x"call _printfadd esp, 8inc esicmp esi, 0FFhjl short loc_401003xor eax, eaxpop esiretn

_main endp

Counter changing

Counter comparison

Jumps

by the presence of the instructions of…

And once again …

Counter changing

for contains instructions of …

Counter comparison

Jumps

Counter changing

Counter comparison

Jumps

for contains instructions of …

Counter changing

Counter comparison

Jumps

for contains instructions of …

Counter changing

Counter comparison

Jumps

for contains instructions of …