Reverse Engineering for Beginners

(avery) #1

CHAPTER 20. LINEAR CONGRUENTIAL GENERATOR CHAPTER 20. LINEAR CONGRUENTIAL GENERATOR


ret 0
_srand ENDP


_TEXT SEGMENT
_rand PROC
imul eax, DWORD PTR _rand_state, 1664525
add eax, 1013904223 ; 3c6ef35fH
mov DWORD PTR _rand_state, eax
and eax, 32767 ; 00007fffH
ret 0
_rand ENDP


_TEXT ENDS


Here we see it: both constants are embedded into the code. There is no memory allocated for them. Themy_srand()
function just copies its input value into the internalrand_statevariable.


my_rand()takes it, calculates the nextrand_state, cuts it and leaves it in the EAX register.


The non-optimized version is more verbose:


Listing 20.2: Non-optimizing MSVC 2013

_BSS SEGMENT
_rand_state DD 01H DUP (?)
_BSS ENDS


_init$ = 8
_srand PROC
push ebp
mov ebp, esp
mov eax, DWORD PTR _init$[ebp]
mov DWORD PTR _rand_state, eax
pop ebp
ret 0
_srand ENDP


_TEXT SEGMENT
_rand PROC
push ebp
mov ebp, esp
imul eax, DWORD PTR _rand_state, 1664525
mov DWORD PTR _rand_state, eax
mov ecx, DWORD PTR _rand_state
add ecx, 1013904223 ; 3c6ef35fH
mov DWORD PTR _rand_state, ecx
mov eax, DWORD PTR _rand_state
and eax, 32767 ; 00007fffH
pop ebp
ret 0
_rand ENDP


_TEXT ENDS


20.2 x64


The x64 version is mostly the same and uses 32-bit registers instead of 64-bit ones (because we are working withintvalues
here). Butmy_srand()takes its input argument from theECXregister rather than from stack:


Listing 20.3: Optimizing MSVC 2013 x64

_BSS SEGMENT
rand_state DD 01H DUP (?)
_BSS ENDS


init$ = 8
my_srand PROC
; ECX = input argument
mov DWORD PTR rand_state, ecx

Free download pdf