Reverse Engineering for Beginners

(avery) #1

CHAPTER 19. MANIPULATING SPECIFIC BIT(S) CHAPTER 19. MANIPULATING SPECIFIC BIT(S)


ANDis executed:


Figure 19.10:OllyDbg:i= 4, is there that bit in the input value? Yes. (ZF=0)

ZFis 0 because this bit is present in the input value. Indeed,0x12345678 & 0x10 = 0x10. This bit counts: the jump
is not triggering and the bit counterincrementing.


The function returns 13. This is total number of bits set in0x12345678.


GCC


Let’s compile it in GCC 4.4.1:


Listing 19.28: GCC 4.4.1
public f
f proc near


rt = dword ptr -0Ch
i = dword ptr -8
arg_0 = dword ptr 8


push ebp
mov ebp, esp
push ebx
sub esp, 10h
mov [ebp+rt], 0
mov [ebp+i], 0
jmp short loc_80483EF
loc_80483D0:
mov eax, [ebp+i]
mov edx, 1
mov ebx, edx
mov ecx, eax
shl ebx, cl
mov eax, ebx
and eax, [ebp+arg_0]
test eax, eax
jz short loc_80483EB
add [ebp+rt], 1
loc_80483EB:
add [ebp+i], 1
loc_80483EF:
cmp [ebp+i], 1Fh
jle short loc_80483D0
mov eax, [ebp+rt]
add esp, 10h
pop ebx

Free download pdf