Reverse Engineering for Beginners

(avery) #1
CHAPTER 52. NEGATIVE ARRAY INDICES CHAPTER 52. NEGATIVE ARRAY INDICES

Chapter 52


Negative array indices


It’s possible to address the spacebeforean array by supplying a negative index, e.g.,array[−1].

It’s very hard to say why one should use it, there is probably only one known practical application of this technique. C/C++
array elements indices start at 0, but somePLs have a first index at 1 (at least FORTRAN). Programmers may still have this
habit, so using this little trick, it’s possible to address the first element in C/C++ using index 1:

#include <stdio.h>

int main()
{
int random_value=0x11223344;
unsigned char array[10];
int i;
unsigned char *fakearray=&array[-1];

for (i=0; i<10; i++)
array[i]=i;

printf ("first element %d\n", fakearray[1]);
printf ("second element %d\n", fakearray[2]);
printf ("last element %d\n", fakearray[10]);

printf ("array[-1]=%02X, array[-2]=%02X, array[-3]=%02X, array[-4]=%02X\n",
array[-1],
array[-2],
array[-3],
array[-4]);
};

Listing 52.1: Non-optimizing MSVC 2010
1 $SG2751 DB 'first element %d', 0aH, 00H
2 $SG2752 DB 'second element %d', 0aH, 00H
3 $SG2753 DB 'last element %d', 0aH, 00H
4 $SG2754 DB 'array[-1]=%02X, array[-2]=%02X, array[-3]=%02X, array[-4'
5 DB ']=%02X', 0aH, 00H
6
7 _fakearray$ = -24 ; size = 4
8 _random_value$ = -20 ; size = 4
9 _array$ = -16 ; size = 10
10 _i$ = -4 ; size = 4
11 _main PROC
12 push ebp
13 mov ebp, esp
14 sub esp, 24
15 mov DWORD PTR _random_value$[ebp], 287454020 ; 11223344H
16 ; set fakearray[] one byte earlier before array[]
17 lea eax, DWORD PTR _array$[ebp]
18 add eax, -1 ; eax=eax-1
19 mov DWORD PTR _fakearray$[ebp], eax
20 mov DWORD PTR _i$[ebp], 0
21 jmp SHORT $LN3@main
22 ; fill array[] with 0..9

Free download pdf