Reverse Engineering for Beginners

(avery) #1

CHAPTER 18. ARRAYS CHAPTER 18. ARRAYS


Let’s try this example in OllyDbg.


We see how the array gets filled: each element is 32-bit word ofinttype and its value is the index multiplied by 2:


Figure 18.1:OllyDbg: after array filling

Since this array is located in the stack, we can see all its 20 elements there.


GCC


Here is what GCC 4.4.1 does:


Listing 18.2: GCC 4.4.1
public main
main proc near ; DATA XREF: _start+17


var_70 = dword ptr -70h
var_6C = dword ptr -6Ch
var_68 = dword ptr -68h
i_2 = dword ptr -54h
i = dword ptr -4


push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 70h
mov [esp+70h+i], 0 ; i=0
jmp short loc_804840A

loc_80483F7:
mov eax, [esp+70h+i]
mov edx, [esp+70h+i]
add edx, edx ; edx=i*2

Free download pdf