Reverse Engineering for Beginners

(avery) #1

CHAPTER 19. MANIPULATING SPECIFIC BIT(S) CHAPTER 19. MANIPULATING SPECIFIC BIT(S)


#define REMOVE_BIT(var, bit) ((var) &= ~(bit))


int f(int a)
{
int rt=a;


SET_BIT (rt, 0x4000);
REMOVE_BIT (rt, 0x200);

return rt;
};


int main()
{
f(0x12340678);
};


19.2.1 x86


Non-optimizing MSVC


We get (MSVC 2010):


Listing 19.10: MSVC 2010

_rt$ = -4 ; size = 4
_a$ = 8 ; size = 4
_f PROC
push ebp
mov ebp, esp
push ecx
mov eax, DWORD PTR _a$[ebp]
mov DWORD PTR _rt$[ebp], eax
mov ecx, DWORD PTR _rt$[ebp]
or ecx, 16384 ; 00004000H
mov DWORD PTR _rt$[ebp], ecx
mov edx, DWORD PTR _rt$[ebp]
and edx, -513 ; fffffdffH
mov DWORD PTR _rt$[ebp], edx
mov eax, DWORD PTR _rt$[ebp]
mov esp, ebp
pop ebp
ret 0
_f ENDP


TheORinstruction sets one bit to value while ignoring the rest.


ANDresets one bit. It can be said thatANDjust copies all bits except one. Indeed, in the secondANDoperand only the bits
that need to be saved are set, just the one do not want to copy is not (which is 0 in the bitmask). It is the easier way to
memorize the logic.

Free download pdf