pointer to the last element found. This loop starts with offset +4. Which ele-
ment does offset +4 point to? How can you tell? There is one hint available.
Let’s see how many elements this loop traverses, and how you get to that
number. The number of iterations is stored in EDX, which you got by calculating
the distance between the last element in the table and the element that you’re
looking for. This loop takes you the distance between the end of the list and the
element you’re looking for. This means that offset +4 in the root structure points
to the last element in the list! By taking offset +4 in each element you are going
backward in the list toward the beginning. This makes sense, because in the pre-
vious loop (the one at ntdll.7C962513)you established that taking each ele-
ment’s offset +4 takes you “backward” in the list, toward the lowered-indexed
elements. This loop does the same thing, except that it starts from the very end
of the list. All RtlGetElementGenericTableis doing is it’s trying to find the
right element in the lowest possible number of iterations.
By the time EDXgets to zero, you know that you’ve found the element. The
code then flows into ntdll.7C96254E, which you’ve examined before. This
is the code that caches the element you’ve found into offsets +c and +10 of the
root data structure. This code flows right into the area in the function that
returns the pointer to our element’s data to the caller.
What happens when (in the previous sequence) EDI == 0, and the jump to
ntdll.7C96254Eis taken? This simply skips the loop and goes straight to
the caching of the found element, followed by returning it to the caller. In this
case, the function returns the previously found element—the one whose
pointer is cached in offset +c of the root data structure.Search Loop 3
If neither of the previous two branches is taken, you know that EDI < EDX
(because you’ve examined all other possible options). In this case, you know
that you must move forward in the list (toward higher-indexed elements) in
order to get from the cached element in offset +c to the element you are look-
ing for. Here is the forward-searching loop:7C962513 DEC ESI
7C962514 MOV EAX,DWORD PTR [EAX+4]
7C962517 JNZ SHORT ntdll.7C962513
7C962519 JMP SHORT ntdll.7C96254EThe most important thing to notice about this loop is that it is using a differ-
ent pointer in the element’s header. The backward-searching loops you
encountered earlier were both using offset +4 in the element’s header, and this
one is using offset +0. That’s really an easy one—this is clearly a linked list of
some sort, where offset +0 stores the NextElementpointer and offset +4
stores the PrevElementpointer. Also, this loop is using EDIas the counter,164 Chapter 5