Reverse Engineering for Beginners

APPENDIX A. X86 APPENDIX A. X86

;

; This function compares two blocks of memory and returns the number

; of bytes that compared equal.

;

; Arguments:

;

; Source1 (esp+4) - Supplies a pointer to the first block of memory to

; compare.

;

; Source2 (esp+8) - Supplies a pointer to the second block of memory to

; compare.

;

; Length (esp+12) - Supplies the Length, in bytes, of the memory to be

; compared.

;

; Return Value:

;

; The number of bytes that compared equal is returned as the function

; value. If all bytes compared equal, then the length of the original

; block of memory is returned.

;

;--

RcmSource1 equ [esp+12]

RcmSource2 equ [esp+16]

RcmLength equ [esp+20]

CODE_ALIGNMENT

cPublicProc _RtlCompareMemory,3

cPublicFpo 3,0

push esi ; save registers

push edi ;

cld ; clear direction

mov esi,RcmSource1 ; (esi) -> first block to compare

mov edi,RcmSource2 ; (edi) -> second block to compare

;

; Compare dwords, if any.

;

rcm10: mov ecx,RcmLength ; (ecx) = length in bytes

shr ecx,2 ; (ecx) = length in dwords

jz rcm20 ; no dwords, try bytes

repe cmpsd ; compare dwords

jnz rcm40 ; mismatch, go find byte

;

; Compare residual bytes, if any.

;

rcm20: mov ecx,RcmLength ; (ecx) = length in bytes

and ecx,3 ; (ecx) = length mod 4

jz rcm30 ; 0 odd bytes, go do dwords

repe cmpsb ; compare odd bytes

jnz rcm50 ; mismatch, go report how far we got

;

; All bytes in the block match.

;

rcm30: mov eax,RcmLength ; set number of matching bytes

pop edi ; restore registers

pop esi ;

stdRET _RtlCompareMemory

;

; When we come to rcm40, esi (and edi) points to the dword after the

; one which caused the mismatch. Back up 1 dword and find the byte.

; Since we know the dword didn't match, we can assume one byte won't.