Reverse Engineering for Beginners

(avery) #1

CHAPTER 7. SCANF() CHAPTER 7. SCANF()


Thescanf()function in our example has two arguments.


The first one is a pointer to the string containing%dand the second is the address of thexvariable.


First, thexvariable’s address is loaded into theEAXregister by thelea eax, DWORD PTR _x$[ebp]instruction.


LEAstands forload effective address, and is often used for forming an address (A.6.2 on page 887).


We could say that in this caseLEAsimply stores the sum of theEBPregister value and the_x$macro in theEAXregister.


This is the same aslea eax, [ebp-4].


So, 4 is being subtracted from theEBPregister value and the result is loaded in theEAXregister. Next theEAXregister
value is pushed into the stack andscanf()is being called.


printf()is being called after that with its first argument — a pointer to the string:You entered %d...\n.


The second argument is prepared with:mov ecx, [ebp-4]. The instruction stores thexvariable value and not its address,
in theECXregister.


Next the value in theECXis stored on the stack and the lastprintf()is being called.

Free download pdf