Reverse Engineering for Beginners

(avery) #1

CHAPTER 7. SCANF() CHAPTER 7. SCANF()


.text:00401050 retn
.text:00401050 _main endp


Now it is slightly easier to understand the code. However, it is not a good idea to comment on every instruction.


You could also hide(collapse) parts of a function inIDA. To do that mark the block, then press “–” on the numerical pad and
enter the text to be displayed instead.


Let’s hide two blocks and give them names:


.text:00401000 _text segment para public 'CODE' use32
.text:00401000 assume cs:_text
.text:00401000 ;org 401000h
.text:00401000 ; ask for X
.text:00401012 ; get X
.text:00401024 cmp eax, 1
.text:00401027 jnz short error
.text:00401029 ; print result
.text:0040103B jmp short exit
.text:0040103D
.text:0040103D error: ; CODE XREF: _main+27
.text:0040103D push offset aWhat ; "What you entered? Huh?\n"
.text:00401042 call ds:printf
.text:00401048 add esp, 4
.text:0040104B
.text:0040104B exit: ; CODE XREF: _main+3B
.text:0040104B xor eax, eax
.text:0040104D mov esp, ebp
.text:0040104F pop ebp
.text:00401050 retn
.text:00401050 _main endp


To expand previously collapsed parts of the code, use “+” on the numerical pad.

Free download pdf