Reverse Engineering for Beginners

(avery) #1

CHAPTER 38. NETWORK ADDRESS CALCULATION EXAMPLE CHAPTER 38. NETWORK ADDRESS CALCULATION EXAMPLE


_ip3$ = 16 ; size = 1
_ip4$ = 20 ; size = 1
_form_IP PROC
movzx eax, BYTE PTR _ip1$[esp-4]
; EAX=000000dd
movzx ecx, BYTE PTR _ip2$[esp-4]
; ECX=000000cc
shl eax, 8
; EAX=0000dd00
or eax, ecx
; EAX=0000ddcc
movzx ecx, BYTE PTR _ip3$[esp-4]
; ECX=000000bb
shl eax, 8
; EAX=00ddcc00
or eax, ecx
; EAX=00ddccbb
movzx ecx, BYTE PTR _ip4$[esp-4]
; ECX=000000aa
shl eax, 8
; EAX=ddccbb00
or eax, ecx
; EAX=ddccbbaa
ret 0
_form_IP ENDP


We could say that each byte is written to the lowest 8 bits of the return value, and then the return value is shifted left by one
byte at each step. Repeat 4 times for each input byte.


That’s it! Unfortunately, there are probably no other ways to do it. There are no popularCPUs orISAs which has instruction
for composing a value from bits or bytes. It’s all usually done by bit shifting and ORing.


38.3 print_as_IP().


print_as_IP()does the inverse: splitting a 32-bit value into 4 bytes.


Slicing works somewhat simpler: just shift input value by 24, 16, 8 or 0 bits, take the bits from zeroth to seventh (lowest
byte), and that’s it:


Listing 38.4: Non-optimizing MSVC 2012

_a$ = 8 ; size = 4
_print_as_IP PROC
push ebp
mov ebp, esp
mov eax, DWORD PTR _a$[ebp]
; EAX=ddccbbaa
and eax, 255
; EAX=000000aa
push eax
mov ecx, DWORD PTR _a$[ebp]
; ECX=ddccbbaa
shr ecx, 8
; ECX=00ddccbb
and ecx, 255
; ECX=000000bb
push ecx
mov edx, DWORD PTR _a$[ebp]
; EDX=ddccbbaa
shr edx, 16
; EDX=0000ddcc
and edx, 255
; EDX=000000cc
push edx
mov eax, DWORD PTR _a$[ebp]
; EAX=ddccbbaa
shr eax, 24
; EAX=000000dd
and eax, 255 ; probably redundant instruction

Free download pdf