Reverse Engineering for Beginners

(avery) #1

CHAPTER 23. POINTERS TO FUNCTIONS CHAPTER 23. POINTERS TO FUNCTIONS


comp()function:


public comp
comp proc near


arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch


push ebp
mov ebp, esp
mov eax, [ebp+arg_4]
mov ecx, [ebp+arg_0]
mov edx, [eax]
xor eax, eax
cmp [ecx], edx
jnz short loc_8048458
pop ebp
retn
loc_8048458:
setnl al
movzx eax, al
lea eax, [eax+eax-1]
pop ebp
retn
comp endp


The implementation ofqsort()is located inlibc.so.6and it is in fact just a wrapper^6 forqsort_r().


In turn, it is callingquicksort(), where our defined function is called via a passed pointer:


Listing 23.4: (file libc.so.6, glibc version—2.10.1)

.text:0002DDF6 mov edx, [ebp+arg_10]
.text:0002DDF9 mov [esp+4], esi
.text:0002DDFD mov [esp], edi
.text:0002DE00 mov [esp+8], edx
.text:0002DE04 call [ebp+arg_C]


23.2.1 GCC + GDB (with source code).


Obviously, we have the C-source code of our example (23 on page 367), so we can set a breakpoint (b) on line number
(11—the line where the first comparison occurs). We also need to compile the example with debugging information included
(-g), so the table with addresses and corresponding line numbers is present. We can also print values using variable names
(p): the debugging information also has tells us which register and/or local stack element contains which variable.


We can also see the stack (bt) and find out that there is some intermediate functionmsort_with_tmp()used in Glibc.


Listing 23.5: GDB session

dennis@ubuntuvm:~/polygon$ gcc 17_1.c -g
dennis@ubuntuvm:~/polygon$ gdb ./a.out
GNU gdb (GDB) 7.6.1-ubuntu
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/...
Reading symbols from /home/dennis/polygon/a.out...done.
(gdb) b 17_1.c:11
Breakpoint 1 at 0x804845f: file 17_1.c, line 11.
(gdb) run
Starting program: /home/dennis/polygon/./a.out


(^6) a concept likethunk function

Free download pdf