Reversing : The Hacker's Guide to Reverse Engineering

00401017 mov ebx,dword ptr [esp+18h]

0040101B shr edi,2

0040101E push ebp

0040101F add edi,1

00401022 mov ecx,dword ptr [edx]

00401024 mov ebp,ecx

00401026 xor ebp,esi

00401028 xor ebp,ebx

0040102A mov dword ptr [edx],ebp

0040102C xor eax,ecx

0040102E add edx,4

00401031 sub edi,1

00401034 mov esi,ecx

00401036 jne 00401022

00401038 pop ebp

00401039 pop ebx

0040103A pop edi

0040103B pop esi

0040103C ret

Listing 10.2 A simple data processing function that XORs a data block with a parameter
passed to it and writes the result back into the data block.

Let us now take this function and transform it using a table interpretation
transformation.

00401040 push ecx

00401041 mov edx,dword ptr [esp+8]

00401045 push ebx

00401046 push ebp

00401047 mov ebp,dword ptr [esp+14h]

0040104B push esi

0040104C push edi

0040104D mov edi,dword ptr [esp+10h]

00401051 xor eax,eax

00401053 xor ebx,ebx

00401055 mov ecx,1

0040105A lea ebx,[ebx]

00401060 lea esi,[ecx-1]

00401063 cmp esi,8

00401066 ja 00401060

00401068 jmp dword ptr [esi*4+4010B8h]

0040106F xor dword ptr [edx],ebx

00401071 add ecx,1

00401074 jmp 00401060

00401076 mov edi,dword ptr [edx]

Listing 10.3 The data-processing function from Listing 10.2 transformed using a table
interpretation transformation. (continued)

Antireversing Techniques 349